Where the line should sit: An analysis of the changing relationship between smart devices, consumer privacy, and the law

 -  -  78

Spread the love

Smart devices have exploded into every facet of daily life in barely a decade. These can be defined[1] as wireless computing devices which are connected to other devices or networks via different protocols such as Bluetooth, WiFi or 3G, which can operate to some extent interactively and autonomously[2]. Smart Phones, iPads, Tablets, and other in-home devices are only a small sampling of what is now available within the industry. Smart devices have an almost unlimited application – they check blood sugar[3],[4], measure physical fitness[5], allow access to the internet[6], and unparalleled communication between individuals. However until recently, these devices had been limited to a relatively reactive state, meaning that much of their capabilities were in response to imputed information. In the past year, new home devices and more sophisticated smartphone programming has seen these abilities extended to the reactive, notably in the case of the Amazon Echo, which constantly listens to its surroundings with a set of very sophisticated speakers, and in new forms of advertising which have seen devices “listening in” for key words, then delivering an advertisement[7]. These new devices raise new legal questions in English and EU law.

The Amazon Echo is a popular “smart home” device. At its most basic a speaker, it is also able to play music, control other smart home devices, and perform many other tasks, as well as continually updating via the cloud to gain new skills.[8] Devices such as the Amazon Echo and competitor Google Home are activated using wake words – in the Echo the default “Alexa” or “Amazon”. Recordings are streamed and stored – accessible at a later date. Recently the Amazon Echo played a somewhat different role – murder witness – in a trial in Arkansas, USA. Here, a prosecutor successfully had recordings of the defendant’s Amazon Echo admitted as evidence.[9] Amazon initially rejected this request on protection of consumer privacy grounds. To whom this information belongs, and the implications on consumer privacy, are far from concrete. The Google Home smart device experienced similar privacy concerns following a recent Burger King ad[10], which while made to play on computers and smart devices also included the relevant wake word “Ok Google” and a question of what a Whopper burger was. This caused the smart speakers to give an explanation from the Burger King modified version of the relevant Wikipedia page. This is suggested to be an altogether different privacy concern than what has previously existed as both cases demonstrate the extent to which smart devices may be listening in.

In England and Wales, the law surrounding smart devices remains complex. EU legislation and traditional tort remedies such as breach of confidence/ misuse of private information remain the primary legal safeguards in such circumstances. EU legislation relating to data protection does provides some protection, primary, this includes Directive 95/46/EC (Data Protection Directive) and Regulation 2016/679 (General Data Protection Regulation) which is set to repeal Directive 95/46/EC. Regulation 2016/679 clarifies that the protection of natural persons in relation to the processing of personal data is a fundamental right under Article 8 of the Charter of Fundamental Rights of the European Union and Article 16(1) of the Treaty on the Functioning of the European Union (TFEU). This newest regulation came into force on 24 May 2016, but will not apply until 25 May 2018. Essentially, these measures harmonise data protection rules across the EU notably making data protection a fundamental right for EU citizens and clarifying rights to the data itself, such as access to one’s own data and a “right to be forgotten”, that being when data is no longer useful, it will be deleted.[11] Though positive, this legislation does not directly address privacy concerns, and by virtue of the UK’s withdrawal from the EU such legislation would need to be addressed domestically.

The law of tort also attempts to provide some solutions, but is focused on a misuse of private information rather than invasion of the right to privacy itself. Campbell v Mirror Group Newspapers Ltd[12] established the test to be satisfied to seek damages or injunctive relief. The test is two-limbed, stating firstly that the claimant must satisfy the court that the information generates a reasonable expectation of privacy and, once this is established, must show the public interest in publication does not outweigh the weight of the privacy claim. Later case law established that in this analysis a proportionality based approach should be undertaken when weighing Article 8 (Right to Private and Family Life) and Article 10 (Freedom of Expression) rights.[13] It is noteworthy that England and Wales does not actually have a tort especially safeguarding the right to privacy, merely a modified action for breach of confidence.

After this brief analysis, it is demonstrable that the instances seen with the Amazon Echo and Google Home devices appear to fall into a somewhat unique categorisation. EU data protection legislation appears to offer the best protection through the rights it gives citizens over their personal data. This however, fails to answer the questions raised by the Google Home advertisement or listening-in features of both devices. Perhaps in this current legal period of change facilitated by the UK’s withdrawal from the EU, it is time for new legislation to be enacted to address what appears to be a significant gap in the protection of consumer privacy.

[1] William L . Hosch, ‘Smartphone’ (Encyclopedia Britannica, 2017) <https://www.britannica.com/technology/smartphone> accessed 3 July 2017.

[2] ‘Definition Of Smart Device | New Word Suggestion | Collins Dictionary’ (Collinsdictionary.com, 2017) <https://www.collinsdictionary.com/us/submission/11527/Smart+Device> accessed 3 July 2017.

[3] Dario Smart Meter Blood Glucose Review’ (Diabetes.co.uk, 2017) <http://www.diabetes.co.uk/blood-glucose-meters/dario-smart-meter.html> accessed 10 July 2017.

[4] Chris Garcia, ‘Glucose Meter, Blood Glucose Meters – Ihealth’ (iHealth, 2017) <https://ihealthlabs.com/glucometer/wireless-smart-gluco-monitoring-system/> accessed 1 July 2017.

[5] ‘Fitbit Supported Devices’ (Fitbit.com, 2017) <https://www.fitbit.com/devices> accessed 5 July 2017.

[6] Zaigham Mahmood, Connectivity Frameworks For Smart Devices (Springer International Publishing 2016).

[7] James Titcomb, ‘Not OK, Google: Burger King Advert Designed To Hijack Google Home Speakers Backfires’ (The Telegraph, 2017) <http://www.telegraph.co.uk/technology/2017/04/13/not-ok-google-burger-king-advert-designed-hijack-google-home/> accessed 5 July 2017.

[8] ‘Amazon Echo – Alexa Voice Service – Amazon.Co.Uk’ (Amazon.co.uk, 2017) <https://www.amazon.co.uk/Amazon-SK705DI-Echo-Black/dp/B01GAGVIE4> accessed 29 June 2017.

[9] CNN Eliott C. McLaughlin, ‘Suspect Oks Amazon To Hand Over Echo Recordings In Murder Case’ (CNN, 2017) <http://www.cnn.com/2017/03/07/tech/amazon-echo-alexa-bentonville-arkansas-murder-case/index.html> accessed 6 July 2017.

[10] James Titcomb, ‘Not OK, Google: Burger King Advert Designed To Hijack Google Home Speakers Backfires’ (The Telegraph, 2017) <http://www.telegraph.co.uk/technology/2017/04/13/not-ok-google-burger-king-advert-designed-hijack-google-home/> accessed 5 July 2017.

[11] ‘European Commission – PRESS RELEASES – Press Release – Agreement On Commission’s EU Data Protection Reform Will Boost Digital Single Market’ (Europa.eu, 2015) <http://europa.eu/rapid/press-release_IP-15-6321_en.htm> accessed 7 July 2017.

[12] [2004] 2 AC 457

[13] S (A Child) (Identification: Restrictions on Publication), Re [2004] UKHL 47; [2005] 1 AC 593

78 recommended
bookmark icon