In a massive data privacy mistake, Amazon shared more than around 1,700 recordings from a user's Alexa voice assistant with another person due to "human error." Reuters first reported the news based on an investigation in German trade publication C't.
The user who received the files, based in Germany, had requested his own data in compliance with the European Union's General Data Protection Regulation (GDPR) but also received access to the files from a complete and total stranger when Amazon sent him a link. The German user who requested the data reportedly does not own or use an Alexa device.
"This unfortunate case was the result of a human error and an isolated single case...” an Amazon spokesperson told Reuters. "We resolved the issue with the two customers involved and took measures to further optimize our processes. As a precautionary measure we contacted the relevant authorities.”
The customer who received the files reportedly got no reply when he informed Amazon about the recordings, but the files were deleted from his download link. However, he had already downloaded them to his computer, according to the C't report. The recordings included a man and a woman who could be overheard making requests about transit, Spotify music and conversations. C't was able to use the recordings to identify the man.
Back in May, a woman in Portland, Ore. found that one of her husband's employees in Seattle, Wash. who was in their contacts list received recordings of their conversation in what Amazon blamed on an "unlikely" series of events.
