Mr. Ultan O'Carroll:

Part of what we were doing in Europe was an opinion on data protection by design. The key takeaway from that is that Article 25 of the GDPR imposes a legal obligation on data controllers, the organisations that create these devices and do the processing, to account for data protection by design in everything they do. It is not just about things like data minimisation or security. It is to do with transparency and the legal basis for how gather consent, the way they process data, the way they design their processing chain from start to finish and how they dispose of information. It has to be effective. It has to be measurable in some respects to ensure that it is effective and that it can be demonstrated to be effective. That is a key part of what they have to do as an obligation.

Article 25 is fairly simple. It is not extensive within the GDPR but it applies horizontally across all activities that data controllers have to do and to account for. Now, as this public consultation period and that opinion comes to a start, and as we get to the point where we can revise it based on public consultation, there are opportunities to emphasise those issues in much clearer ways. GDPR allows us to do that in a number of cases with other accountability tools, such as codes of conduct and certification. One might for instance see a code or certification like with signage for CCTV, which might say:

This is a voice processing device. It does these things. It may use human review in certain cases. Your choices are explained here. You can withdraw consent here and here.

Those are the kinds of possibilities that are available for transparency measures but it is very much to do with that difference in modality between what we are used to dealing with keyboards and computers to in-home devices where our voices are being processed, where the processing is sometimes invisible or it could be said to be that because it is going on in the background. It is ambient. That changes the way we interact with these things and it changes our expectations as well.