By Susan Wolf
If you are like me, and currently self-isolating, then it is entirely possible that you are spending more time than usual browsing the internet, doing online shopping, buying books on your Kindle or watching movies on Amazon Prime. However, if you are looking for something educational (and food for thought) then I would recommend you take the time to watch the Panorama documentary “Amazon: What They Know About Us” screened on BBC 1 on 17th February 2020. You can draw your own conclusions, but for me the documentary made scary viewing and raised so many data protection issues that it made my head ache.
The programme charts the almost exponential growth of Amazon from 1994, when it was an online book seller, to the current position as ‘corporate superpower’.
According to Wikipedia Amazon is now the second company in history to reach a market cap of $1 trillion and Jeff Bezos, Amazon’s Chief Executive and founder, is described as the richest person on the planet. Whilst a great deal of this is already well known, the programme sheds light on Amazon’s more recent entry into other markets, and it is these current and prospective ventures that are particularly concerning from a data protection and privacy perspective.
It’s all about the data
Right from the start, Amazon fully understood the value of personal data. Its mission to be the ‘earth’s most customer centric’ company sounds very positive. However such ‘altruistic’ ambitions disguise the company’s mission of turning our personal data into big bucks. As one commentator, a Harvard Business School Professor notes, users of Amazon are not in fact just customers, they are ‘sources of raw material’ and that raw material is the personal data that Amazon collects every time we interact with it.
So how does Amazon collect so much data?
As early as 1995 Amazon recognised that it could use the data supplied by its online purchasers, through their browsing history and online purchases, to predict what books, music or videos they might be interested in purchasing. Later they appointed computer scientists to use algorithms to record and track all the personal data to create ‘digital DNA profiles’ of customers. By selecting one individual customer they had the capacity to predict ‘everything about that person’ based on what that customer clicked and didn’t click (their click streams histories).
As Amazon expanded into Amazon Market Place it invited other sellers onto the platform, in order to become the “everything store”. Amazon used a standard agreement with third party sellers that enabled them to sell their products on the Amazon platform, but effectively gave Amazon the rights over the sellers’ customer data.
These agreements allowed Amazon to operate as both a retailer and a marketplace and to use customer data from third party sellers to secure a competitive advantage against them. In July 2019, the EU Competition Commission opened up an investigation into the possible anti-competitive behaviour of Amazon, which could result in a possible fine of up to 10% of its annual global turnover under EU competition rules.
Of course, anybody using the Amazon website is entitled to review the company’s Privacy Notice to see what personal data is collected and why it is processed.
However, even to my relatively trained eye this doesn’t really convey the full extent of how much personal data Amazon collects from people whenever they use an Amazon service. One privacy campaigner made a request to Amazon for details of her click stream history (as anyone can do under the right of access using Article 15 of the GDPR). She was shocked to discover that 100 purchases had generated 15,000 pieces of information about her, based on her click stream. Amazon were able to tell which days she had taken holidays, or was sick, or when she couldn’t sleep at night.
The sheer volume of personal data that Amazon collects, and processes is demonstrated by the fact that Amazon operated a data warehouse called ‘Helix’ to analyse customers’ personal data ‘over the entirety of their lifetime’. It processes the data of hundreds of millions of people worldwide.
What about Alexa?
The BBC documentary also touches on one question that I have frequently heard people ask: ‘Can Alexa (Amazon’s voice assistant) listen to my conversations?’. The answer is yes. Amazon acknowledges that their workers can listen to anything that you say when the Amazon Echo’s blue light is on, and some of these private conversations are transcribed. If that’s disturbing, then Amazon’s ambitions for Alexa are even more worrying.
Amazon aspires for most things in the home to be Alexa enabled. This could result in the entire activity in the home being recorded. The more people interact with Alexa the more information that Amazon will be able to collect, or as one person said, it wants everything that people do in their homes to be ‘mic’d’ and recorded.
Coupled with this the company has obtained a patent that will enable Alexa to embed certain ‘sniffer’ algorithms to identify ‘trigger words’ that will enable Amazon to send direct marketing messages to Alexa users. Amazon says it has no current plans to do this, but equally is doesn’t refute the possibility. Commentators say that this increased data collection, particularly collecting data about people in their homes, will enable Amazon to start influencing and shaping people’s behaviour, and this constitutes a real threat to democracy and privacy.
Doorbells and Drones
In 2019 Amazon made nearly $12 billion profit and used some of that profit to buy into other lucrative markets that enable it to collect yet more data about people.
The BBC documentary charts the purchase of ‘’Ring’ a manufacturer of smart video doorbells. These doorbells allow users to record anyone who comes to their door, and are marketed as a means of ensuring the security of people’s homes (See Ring UK). However, in practice they are most likely to capture images of friends and neighbours and people delivering goods. (Forgive me for being sceptical but I wonder how many burglars or intruders are polite enough to ring first). However, Amazon is known to have given 1000 ‘Amazon Ring’ doorbells to three police forces in the UK and these are being embraced by Suffolk Police for their crime fighting potential. (Amazon may have provided free doorbells to other police forces but, in response to a BBC freedom of information request, only three police forces have confirmed that they have received the free doorbells.)
At this point you may be thinking that extra home security is a good thing. However, in America Amazon has created a ‘Ring Neighbours app’ that enables ‘ring’ users to share footage with others to create a digital neighbourhood scheme. This data is being shared with 913 US police forces who can obtain the data with the resident’s consent and without a warrant. There are concerns that the app may become available here in the UK.
According to Amazon the ring doorbells are not marketed as a surveillance device. However Tony Porter, the Surveillance Camera Commissioner considers that if the app were to be introduced into the UK it would change the dynamic of the surveillance from being a community form of reassurance to a state form of surveillance.
This clearly needs to be addressed by the Information Commissioner and through the General Data Protection Regulation. Tony Porter states that “we could end up living in a surveillance state.”
Then there is the Prime Air Drone; a delivery aerial drone equipped with cameras and sensors. Two weeks after its launch in 2019, Amazon was granted patent rights to allow it to use delivery drones for aerial home security. Amazon calls this ‘surveillance as a service’ and that the drone would be an ‘opt in’ service. However, even a fully consented opt in by subscribers of this service would not address the privacy issues of others who would inevitably be filmed by such drones. According to the Surveillance Commissioner, this could take us into a whole new area of unregulated territory and a shift into a surveillance state.
Save for some statements by the Surveillance Camera Commissioner, the documentary doesn’t address the data protection issues in particular whether the activities of Amazon comply with the General Data Protection Regulation(GDPR). However, it quite clearly raises numerous issues about lawful and transparent processing and several other GDPR compliance issues.
Jeff Bezos’ take on this is that the Amazon’s use of our data should be for us to decide. The implication being that if users aren’t happy then they don’t need to use Amazon services. However, as one former Amazon Executives says, “don’t necessarily see it as Big Brother if it is done carefully”, which probably reflects the fact that most people don’t really know the full extent of what is going on.
Susan Wolf is an associate with Act Now Training.
More on this and other developments in our GDPR update webinar. Looking for a GDPR qualification from the comfort of your home office? Our GDPR practitioner certificate is now available as an online option.
