Data Protection Concerns Rise Over AI Surveillance Practices

The data protection authorities in North Rhine-Westphalia and Berlin have recently released their activity reports, highlighting significant challenges posed by artificial intelligence and video surveillance, alongside a rising incidence of data breaches. Bettina Gayk, the Data Protection Officer for North Rhine-Westphalia, emphasized that data protection is not a hindrance but a crucial concern for the public, insisting that individuals deserve to have their data safeguarded and their concerns taken seriously by policymakers.

One emerging trend in the call center industry involves the use of AI-driven emotion analysis, which assesses customer and agent voice characteristics such as tone, intensity, and rhythm in real time. Gayk evaluated such a system at an online marketing firm and deemed it a substantial infringement on the personal rights of individuals, as it allows extensive insights into their personalities without a legal basis for processing their voice data.

Furthermore, the reports raised concerns about smart smoke detectors with climate monitoring capabilities in residential buildings, which can no longer have their functions activated without tenant consent. Another case involved an online weather platform that shared users' location data with third parties without valid consent, an action that has been prohibited. The data protection authority also scrutinized insurance companies that exchanged sensitive health information via email without authorization.

Gayk expressed her disapproval of proposed plans to centralize data protection oversight, arguing that this would not lead to a reduction in bureaucracy or cost savings. She believes that the localized supervision is vital for supporting small and medium-sized enterprises and that a shift to federal oversight would disrupt established frameworks and make guidance more difficult.

In her warning against the erosion of data protection in favor of new security laws being discussed at both federal and state levels, Gayk highlighted the troubling idea of employing AI for facial recognition and granting the Office for the Protection of the Constitution access to private surveillance systems. This could lead to unwarranted surveillance of countless individuals who have not engaged in any suspicious activities, representing a significant violation of civil liberties.

Additionally, the North Rhine-Westphalia authority is set to assess whether public prosecutors are processing personal data in compliance with data protection regulations. However, Gayk noted that the Justice Ministry has been obstructing this oversight, challenging the authority's jurisdiction and independence.

Meike Kamp, the Data Protection Officer for Berlin, also focused on the implications of AI, video surveillance, and biometric facial recognition in her report. She criticized the use of facial recognition technologies by the Berlin Public Prosecutor's Office, citing insufficient legal foundations and a lack of necessary impact assessments, which could lead to severe infringements on fundamental rights, especially since biometric features are immutable and can affect many innocent individuals.

The reports also addressed incidents involving police officers who improperly accessed personal data from police databases for non-official purposes. The surveillance of the Kottbusser Tor police station was deemed disproportionate and lacking proper legal justification. Kamp advocates for more transparency, noting that affected individuals are often inadequately informed about how their data is used in AI systems.

Data from the Berlin report indicates that companies have been utilizing personal data for AI training without adequately informing users. One company reportedly used all customer communications for AI training without consent, while another sold user-uploaded images for the same purpose without notifying the individuals involved. Kamp announced plans for increased scrutiny in this area, particularly concerning transparency and risks of discrimination associated with biased data.

The report also highlighted incidents of unauthorized advertising practices, where organizations utilized address brokers to send unsolicited promotional materials. In one instance, a political organization sent out election campaign materials to individuals without prior consent, employing detailed demographic targeting.

Since 2019, the French company Doctolib, known for its online appointment booking system for medical services, has been featured in the Berlin data protection reports due to uncertainties regarding the appropriate supervisory authority for its operations in Germany. The Berlin authority clarified that generally, the French data protection office is responsible for imposing penalties on Doctolib. This clarification underscores the necessity for companies to provide accurate information regarding the responsible data processing entity.

In conclusion, the reports indicate an upward trend in complaints and data breaches, with Berlin recording over 6,000 complaints and approximately 1,262 reported data breaches. Financial penalties totaling EUR80,190 were imposed, with significant fines resulting from security vulnerabilities in medical practice management software that allowed unauthorized access to sensitive patient information.