Dr. Benjamin Cowan:

I thank the Chairman, members of the committee, parliamentarians and all who have been involved in convening this committee. I feel honoured to be have been invited to give evidence.

I would like to give the committee an overview of the research I lead in digital assistants at UCD and at the ADAPT centre. I lead research into the user experience and user behaviour with voice-based devices and technologies. This includes looking at the barriers users see when interacting with these devices, as well as the opportunities to improve our experience with these devices. Our recent focus in both UCD and the ADAPT centre is on the growing importance of user trust with these devices as well as other artificial intelligence technologies. Colleagues such as Dr. Marguerite Barry also work specifically on the role of data ethics. I would like to specifically thank Dr. Barry and her PhD student, Mr. Gianluigi Riva, who have contributed significantly to the evidence I am about to give.

I wish to put this into context. It is hard to overestimate the prevalence and increasing reach of voice-based technologies. Smart speakers have been a catalyst for huge growth in the popularity of voice as a way of interacting with our technology. It is estimated that the number of smart speakers installed will grow to 207.9 million by the end of this year, with a lot of this growth taking place in China and the US. Data estimates suggest that this will grow to 500 million units by the end of 2023. For Ireland, just under 10% of households now own one of these devices and that figure is growing. This is a major technology that is being placed in people's homes and a major way in which people interact with devices. We also have these agents in our smartphones, so there is one in our pockets almost all the time. The reach of this technology is huge. Voice assistants are being used in cars, in healthcare contexts and in the home.

Especially in the case of smart speakers, these devices are becoming social devices by default, placed in public spaces in the home with multiple people interacting with each device. That includes friends, relatives, parents and children. The devices gather data on people who live there, as well as people who visit. They are the gateway to the Internet of things, whereby we use commands to control devices in our homes such as lights, alarms, doors and other devices. This is the context within which these technologies are being used.

I will not outline how these devices work, as we have covered that already. The data generally are used to improve the way the system operates. The more data the organisations that develop these systems have, the better the system can be at matching what a user says and how it behaves. The artificial intelligence techniques that are used, which were mentioned previously, benefit from large amounts of data. That is why these data are incredibly valuable. There is no two ways about it; these devices record our speech. Voice recordings include the information a user sends to the device but they can also include other bits of information. Paralinguistic cues such as intonation or prosody can be used to estimate age, sex and even native language. These recordings can potentially be used to build a version of a user's voice for particular commands and to impersonate the user. With the use of third-party applications, these data are also likely to be transmitted, shared or stored using other infrastructure. We must consider that infrastructure's potential security flaws. As we have mentioned previously, these devices can record users unintentionally, accidentally picking up and storing this audio. It is clear that these issues need to be addressed, and I am glad that this committee has been called to discuss them.

What do we need to think about when it comes to digital assistants? First, we need to be clear about it means to say that these devices are technically "always on". That means there is a microphone in every home and in every pocket. It might be waiting for a particular word or utterance but it is listening. At best, these can record accidentally. At worst, this information could be intercepted and used to monitor users. That may not be happening now, but it is a possibility. This seems unnecessarily intrusive to me. It may not be to others, but users have to be made aware of the fact that the microphones on these devices are always on.

We must also be clear on why data are being stored, who accesses them and with what they are being combined. Currently the reasons data are kept are opaque to the user. The purpose is summarised as making improvements to the system. Data gatherers must be more explicit about how these data are used in terms of tracking, profiling and sharing across an organisation, as well as what is being shared with third-party organisations. This needs to be outlined explicitly to the user, along with how the data are paired with other streams to influence the experience.

Moreover, users currently have no control over what companies can access or use these data. This means there is no opportunity for users to have an active ongoing voice in how the data are used. It also bakes in the competitive advantage of big data players, who can use this ocean of speech-based data to improve their systems while competition is left with little data to play with. This makes it hard for smaller startups, of which there is a thriving community in Dublin, who may change the way these systems operate to compete. For example, startups could change the way the systems work from a privacy perspective if they had the chance to build them more effectively. Giving users control of their data could also allow them to choose where their data recordings reside. It could lead to a boom in research in the area, as users could potentially donate data to non-profit organisations or research if they so desire.

We must also consider consent mechanisms for users. Currently these systems are used in public spaces by multiple users. A smart speaker in a kitchen or a living room captures audio recordings of several users, including neighbours, visiting relatives and children. None of these have consented to their data being recorded and stored but all are potentially being recorded. We need to discuss what that means and consider new mechanisms by which consent can be given for these data to be used.

We must also discuss the principle of privacy by design. We must consider how we can include privacy as a standard feature of the design of these devices. Some smart speakers include the option to turn off the microphone so it is not always on. "Push to interact" mechanisms would also reduce the likelihood of the accidental recording of data. We must also be aware of what these decisions mean for the user.

This type of design decision has a trade-off for users as far as convenience is concerned, whereby they might want to use the voice to initiate the agent in hands-busy, eyes-busy situations in which these technologies are really useful. We need to have a conversation about how we can bake in privacy by design.

Our work shows that privacy is a concern for users. Although it might not seem that it is influencing their behaviours yet, it is in the companies' and governments' interests to address this head-on. The data we are talking about are not a set of clicks, a search history or a set of cookies but rather our voices. Users perceive the latter data as far more personal. A hack or misuse of these data would be significant, and such a threat is potentially real. As users, therefore, we should have our eyes open as to what it means when we invite digital assistants into our homes.