A patent was recently granted to Spotify allowing the streaming service to suggest songs to its users based on their emotions. Using speech recognition technology, in addition to emotions, Spotify can also collect information about the user’s age, gender and environment.
Although some will find it a godsend, speech recognition technology is a far-reaching development, giving Spotify a peek into our lives, as it were. And do I want to be suggested a depressing song when I’m already in ashes? I doubt it.
How does this work from a legal point of view? This technology is at odds with the European privacy legislation (the GDPR). When making recommendations based on emotions, gender, age and environment, Spotify processes personal data. Therefore it must comply with the relevant legislation.
The processing of personal data under the GDPR cannot be done without a legal ground. A well-known basis for processing personal data is the consent of the person whose data is being processed (for example, when you give permission to receive a newsletter, or for the use of (non-functional) cookies).
Personal data relating to health, such as emotions, are special personal data which, due to their specific nature, deserve extra protection. The processing of these data is fundamentally prohibited. However, when a number of exceptions have been met, including explicit consent or necessary processing (for example, the processing of health data of a hospital patient with a view to an operation), the data can be processed.
It is not yet clear whether Spotify will actually use the speech recognition technology. There will also be a difference between use in Europe and the United States, where the GDPR does not apply.
If you want more information on the GDPR, or if you have any other privacy related questions, please contact Michelle (Michelle@thelegalgroup.nl) or Helen (Helen@thelegalgroup.nl).