A smart television that could eavesdrop on private conversations in New Zealanders' homes breaches a number of privacy principles, the Privacy Commissioner says.
Samsung's privacy policy says the technology in its Smart TV service can capture information spoken by users and will transmit it to a third party.
"Please be aware that if your spoken words include personal or other sensitive information, that information will be among the data captured and transmitted to a third party through your use of Voice Recognition," the policy says.
Voice recognition allowed the user to choose to control the TV using voice commands in addition to their remote control.
Privacy Commissioner John Edwards said the function appeared to breach collection principles under the Privacy Act.
"It is hard to imagine a lawful purpose for a TV manufacturer to collect voice communications not directed at the TV."
He said he would also look into the adequacy of the privacy policy disclosure.
"Even if there was a disclosure of the fact of that kind of collection in the privacy policy, I'd be prepared to look at the fairness and intrusiveness of the practice."
Consumer NZ technology writer Hadyn Green said the problem lay with the third party element.
"They may not have the same privacy standards that Samsung does - so there is potential that your personal information, whatever it may be - and it may not actually be that scandalous - goes out on the net."
The smart televisions had been on the market in New Zealand for "a couple of years", Mr Green said.
"Our main standpoint is always...read the privacy statement.
"A privacy statement inside the terms and conditions is always the most important part, especially these days."
Samsung would not reveal how many of the smart TVs had been sold in New Zealand due to commercial sensitivities.
But it defended the setting and said claims that users' conversations were recorded without their knowledge were "groundless".
A statement from the company today said it took its consumers' privacy extremely seriously and at all times aimed to be as transparent as possible with regard to privacy policies.
Voice recognition allowed the user to choose to control the TV using voice commands in addition to their remote control and was a Samsung Smart TV feature, which could be activated and deactivated by the user.
"The claims made by overseas tech news media that Samsung is transmitting collected voice data to a third party to 'sell ads' and that 'users' conversations are recorded without their knowledge', are completely groundless."
Firstly the user was given a choice to activate or deactivate the voice recognition, the statement said.
"Secondly, users can easily recognise if the voice recognition feature is activated because a microphone icon appears on the screen when consumers enable the voice recognition capability.
"Thirdly, voice recognition is enabled only when users agree to the separate Samsung Privacy Policy and Terms of Use regarding this function when initially setting up the TV.
If a consumer consented and used the voice recognition feature, voice data was only given to a third party voice-to-text conversion provider during a requested voice command search. At that time, the voice data was sent to a server that searches for the requested content then returns the desired content to the TV, the statement said.
Possible breaches of the Privacy Act
* An agency should only collect personal information where it had a lawful purpose to do so, and the collection was necessary for that purpose.
* Agencies had to be open about their purposes for collecting information. They had to take "reasonable steps to ensure" the individuals were aware of the fact of collection and the purpose for it.
* Agencies were prohibited from collecting information by means that were unfair, or "intrude unreasonably on the personal affairs" of the individual concerned.
(Source: Office of the Privacy Commissioner)
