alexa gdpr - Woman In Kitchen Asking Digital Assistant Question

The government recently announced it would be partnering with Amazon to offer NHS medical advice through Amazon’s Alexa virtual assistant devices. This will work by Alexa using health information from the NHS website to provide answers to users’ medical queries. For example a query of “Alexa, what are the symptoms of a migraine?” would result in the migraine symptoms page on the NHS website being read back to the user by Alexa. Before this agreement, Alexa users asking health questions would be taken to various popular search responses rather than NHS-verified information.

In making the announcement this week the Health Secretary, Matt Hancock, has said this use of Alexa could help reduce demand on the NHS. He said it will mean that users can get professional NHS-verified health information in seconds in their own homes with simple voice commands.

It is thought this use of NHS health information will be particularly beneficial for vulnerable patients such as the elderly and visually impaired who may struggle to access internet through traditional means.

Some critics have raised data protection concerns both over the government allowing Amazon to access NHS information in this way and how Amazon deals with sensitive personal data gathered through users use of Alexa for health queries.

Amazon has said all user information will be kept confidential and third parties will not get access to it in order to market health products. Amazon stores voice recordings from Alexa permanently unless you delete them and voice recordings can be listened to by the account holder with potential privacy concerns for users in shared households.

Amazon has been subject to other data protection criticisms recently, notably in April 2019 when Bloomberg News reported that Amazon employees around the world regularly listen to recordings from Alexa users as part of the effort to eliminate the gap in Alexa’s understanding of human speech.

There are also wider privacy issues here around how voice-controlled devices may gather data about users’ health and other sensitive information and how this personal information could be exploited. Amazon has said they will not use users’ health queries to build a health profile of users but this is still a concern for privacy campaigners.

This is an interesting new development in the two expanding and emerging markets of e-health and voice-assisted technology. E-health is an expanding market and the technology that is used in healthcare sector has the potential to transform healthcare delivery and lower costs for the NHS if the government’s NHSX unit for use of digital technologies in the health sector can get to grips with the increasing data protection issues. Companies working in this sector can have an eye on these opportunities for new collaboration but must also consider the strength of their internal data protection provisions in light of the new high fines the Information Commissioner’s Office (ICO) is able to levy for breaches of the General Data Protection Regulation (GDPR).

Voice-controlled products is another emerging market. It is estimated that by 2020 half of all internet searches will be made through voice-controlled technology. Considering the increasing availability of these sorts of products, this health partnership could pave the way for more organisations to make their valuable knowledge accessible by voice-controlled products. Companies that are thinking about harnessing voice-control technology will need to build strong privacy protections into the technology from the outset of each project in line with the Privacy by Design approach mandated by the GDPR.