Content

Voice searches using voice recognition software such as Google virtual assistant tend to be more conversational, even starting with a greeting: “Hey Cortana” and signing off: “Thank you Siri.” Voice searchers use specific, full length questions not keywords. Siri, Google assistant, Alexa and Cortana are different to text searches so a different approach with more long tail keywords is needed to rank highly in their search engine results pages (SERPS.)

Questions and voice search are a powerful new phenomenon that can inform marketers of content gaps and engagement opportunities. It’s very important that the search results are relevant because voice searchers often select the first search result unlike text searchers.

For example, a visitor may ask Google Assistant or Siri: “Where can I have a family meal for four for £80 up to a maximum of £100? If they are given a choice, the tourist may then ask: “Which restaurant has the best reviews?” As you can see location is very important with voice search engines able to rank their results according to opening hours, expertise and customer service ratings.

Voice searches are about meaning, context and intent not just keywords and this change needs to be reflected in marketers’ SEO strategies that must now cater for voice and text searches.

For voice searchers the customer journey is very important and should encourage searchers to look around if they are using Amazon’s Alexa UK, for example. Marketing and advertising needs to be discreet and personalised. Voice search also needs to be a strategic part of any campaign, not just an afterthought added on at the end. A customer must be able to switch effortlessly between voice and visual text based searching using complementary not competing technologies.

Astute marketers will identify and harness the opportunity provided by voice search to reveal what customers want and need. It’s a growing field, particularly among young people and mobile phone users. According to Google, 20% of mobile searches are already voice searches. Comscore, a marketing analytics company, estimates that by 2020, 50% of all searches will be voice searches so it is essential that businesses learn how to be found by voice search engines.

Google released its guidelines for voice search four months ago, you can read them here. Marketers should seize the opportunity to engage with this new platform early making search more relevant and specific to their customers’ needs which will bring in new business for their clients.

However, everyone should take a careful look at the privacy policies of each voice assistant so that marketers can advise clients and customers of the type and amount of data stored and how to delete or disable it.

A note of caution for voice searchers

Both marketers and users of voice search must be aware that their devices are recording conversations and collecting data. Apple appears to be the best currently by anonymising information Siri transmits and deleting it when the voice search user turns Siri off.

Google assistant provides access to contacts, calendar, name, search history, voice and audio activity in order to deliver targeted advertising (which helps keep services free) and it stores conversations. It does not sell personal information to anyone but it admits to sharing information with affiliates and partners such as restaurants or airlines. It is up to the Google user to delete stored information.

Cortana listens in and provides access to calendar, email, messages and other content in the background even when the device is locked by default, although the feature can be disabled.

Amazon Alexa UK similarly collects a lot of information as outlined in its privacy policy. That data can include a name, email address, country of origin, nickname, telephone number, website, company and title for example, as well as browsing history, information about your operating system and a unique identifier enabling Alexa to identify the user’s device, and the date and time the information was logged. However, Amazon insists it does not actively try to determine the identity of any Alexa user.

One problem with most of these voice assistants is, with the exception of Siri, the user needs to remember to disable them if they don’t want them listening in. Anyone can access the assistant from your home without passing through voice identification which is a form of security used by mobiles.

Voice search is a growing phenomenon  and here to stay so marketers, businesses and users need to learn how to harness its potential while protecting their privacy.

Personal data according to the general data protection regulation (GDPR) refers to anything that can identify an individual including CCTV cameras. Footage can be used as surveillance to deter or identify intruders and if so, must be available to the Police as required. It must be stored securely and encrypted wherever possible.

GDPR is a new European regulation governing data protection but the UK is introducing a very similar piece of legislation which will apply after Brexit. Personal data includes CCTV footage, email marketing, social media posts, names including newsletter recipients, European cloud storage, IP addresses for websites as well as data already in scope under existing data protection law. GDPR is overseen by the Information Commissioner’s Office (ICO.)

It allows individuals to request a copy of any CCTV footage where they are clearly identifiable. If the request is valid, the organisation must show the footage to the individual within 30 days. GDPR will take effect in just over three months’ time on 25 May this year, 2018, and businesses need to be ready. It is very important that organisations get the use of data right because they can face fines of up to 20 million Euros or 4% of global turnover if they get it wrong. GDPR is overseen by the Information Commissioner’s Office (ICO) who set the fines.

Individuals must give active consent that is, ‘freely given, specific, informed and unambiguous’ so implied consent will no longer be sufficient. Organisations must make CCTV cameras very obvious and may need to obtain further explicit consent from individuals to record them.

Security operator looking at CCTV footage

To remain on the right side of the law, organisations must make sure that they can switch CCTV on and off and access a specific recording upon request. Footage and sound recordings should be captured separately to avoid being excessive and must be stored securely. Take care with sound recordings because it is intrusive to record conversations of staff or the public unless there is a strong and explicit justification which is unusual.

Access to footage and sound should be restricted and safeguards need to be in place to prevent interception and unauthorised access.  Footage should be deleted when it’s no longer necessary.

All CCTV footage needs to be underpinned by a written information retention policy that is understood by all operatives. Staff need to know how to respond to requests from individuals for access to footage and recordings. Individuals also need to know if they are in an area covered by CCTV and that they have a right to access recordings and footage.

CCTV security cameras must be clearly visible

Currently data in the UK is regulated by the Data Protection Act 1998 that followed the 1995 EU data protection directive. However, this is now being superseded by the EU General Data Protection Regulation which brings the law up to speed with new ways that data is being used. There will be tougher fines for breaches of data protection and the regulation gives individuals more say over what companies do with their data. GDPR standardises practice throughout the EU.

Even after Brexit if UK companies want to trade with companies in the EU, they will have to comply with GDPR and the UK is introducing a very similar piece of legislation. Personal data includes email marketing, social media posts, names including newsletter recipients, European cloud storage, IP addresses for websites as well as spreadsheets, photos, CCTV footage and documents.

Personal data is data that identifies a person, data under the Data Protection Act will fall under the scope of GDPR. People can ask for data at reasonable intervals and controllers have a month to respond. Controllers and processors should explain why the data is being processed, how long it will be kept and who will see it. An individual can ask for the data to be corrected or completed if they think it is incomplete or contains errors.

You need to get active consent from everyone you hold data about and you need to be prepared to delete files as required. Failure to opt-out no longer defaults to consent. Consent must be explicit and intentional. Consent gained before GDPR became law must meet the new high standard to be current. If you are in doubt, get updated active consent from all your subjects to ensure GDPR compliance.

Individuals can request that their data is deleted after it has been used which is called the ‘right to be forgotten.’ The same rule applies if they withdraw consent or dislike the way it is being processed. The controller is responsible for telling Google, for example, to delete links to copies of the data and copies of the data itself.

Businesses such as Google and Facebook share user data. GDPR has been introduced to regulate this to build trust and standardise data protection across the EU. This should reduce legal fees considerably.

GDPR will take effect across the EU from 25 May 2018 in its current form without the need for Member States to introduce their own national legislation. It applies to controllers of data who have strategic oversight of the data (such as a government) and processors (often IT companies) who process it. Controllers can be liable for a breach by one of their processors.

The clock is ticking before GDPR takes effect.

Controllers need to check that personal data is processed lawfully, transparently and for a specific purpose. When it is no longer needed, it should be deleted. Controllers need to record active consent to keep the data which can be withdrawn at any time.

Data breaches

Data breaches in the UK need to be reported within 72 hours to the Information Commissioner’s office. You should explain what data has been exposed, what impact this will have for the people involved and what steps you’ve taken in response to the breach. You must also tell the people affected or face a hefty fine. Fines are becoming much bigger and are often 2% of annual turnover rising to 4% if a controller or processor does not follow procedures. Fines still need to be proportionate and evidence of compliance with GDPR will show good faith and should reduce the fine.