For disclosure I did a search on Alexa first to see if this has come up before. It seems it hasn't.
As part of our authorities embrace of new technology the service wants to allow Alexa to be asked when the next bin collection will be (initially...)
Person "Alexa, ask the council about my bin collections"
Alexa "would you like to set up an address or use the address on your Amazon account or would you like to use your current location"
Person "set the location to device location"
Alexa "your location is xxxxx"
The information on the address is held in a local land property gazette managed by the council and Alexa will have access to this public information through a portal connection to the local authority.
A log is kept on the amazon portal of the request for information containing the full property address, and a obfuscated amazon account reference (which only Amazon could decode to recover the name and details attached to the account). The customer has already supplied the address to amazon and consented to the use of Amazon.
A customer of most local authorities can go onto a portal online and search using an address to see when the next bin collection will be so this information is already publically available down to address level but what complicated things is the technology being used to do this links a reference/account of a person with the address which may constitute personal data.
It seems to me that the chances of re-identification of a person at the property through using this service is slim to none. The spatial information advice from the ICO states that approximately 15 properties could be identified by a full postcode but with no way to identify which individual in a household made the request for information I cannot see how you could identify an individual. The amazon account is not provided to the Council and all that amazon will record is that one of their account holders made a request to see when bins were collected at a particular property.
If it was logging the name or other PII and the address of the person I would look at this differently but I feel that there is no concern with this new service. Does this mirror the groups thoughts? trying to get some assurance..
Alexa has let down a few people already and there is a good article here - https://gdpr.report/news/2018/05/28/importance-of-data-accuracy-and-the-alexa-mishap/
Have a good weekend all
All archives of messages are stored permanently and are
available to the world wide web community at large at
If you wish to leave this list please send the command
leave data-protection to [log in to unmask]
All user commands can be found at https://www.jiscmail.ac.uk/help/subscribers/subscribercommands.html
Any queries about sending or receiving messages please send to the list owner
[log in to unmask]
Full help Desk - please email [log in to unmask] describing your needs
To receive these emails in HTML format send the command:
SET data-protection HTML to [log in to unmask]
(all commands go to [log in to unmask] not the list please)