Voice input, data, privacy and 152-FZ: a guide for those who work with other people's data

Potok transcribes Russian speech; this site has been translated into English for convenience.

With voice input, speech almost always goes to a server for recognition: cloud services do not work otherwise. For personal correspondence the server's country usually does not matter, but for a personal data operator under 152-FZ it is a legal requirement. Potok (potok.now) has a mode that complies with 152-FZ, servers in Russia and, on request, a variant with servers inside the company perimeter.

Personal data is any information that relates to a specific person: a name, a phone number, an address, a diagnosis in a medical record. In voice input, such data is spoken as often as in an ordinary letter, and dictation almost always sends audio to a server for recognition. In practice this means the location of the server is sometimes not a technical question but a legal requirement.

Words you will meet in this section

The materials in this section regularly use terms from 152-FZ and related data legislation. Below is a short account of what they mean for voice input; for detailed definitions and examples see the table of terms further down the page.

• Personal data: a client's name, phone number or address spoken in dictation.
• Personal data operator: the organization that decides why and how data is processed, including texts that employees dictated into work systems.
• Personal data subject: the person the data is about.
• Processing of personal data: any action with it: collection, recording, storage, transfer, deletion. Saving the dictated text to a database counts too, even if the dictation itself lasted a couple of seconds.
• Data localization requires storing the data of Russian citizens on servers in Russia.
• Cross-border data transfer is its movement outside the country, and 152-FZ restricts such a transfer without additional conditions, and this applies to any way of transfer, including processing in the cloud of a foreign service.
• Special categories: health data and other especially sensitive information.

• Voice input and personal data processing: what to check before choosing a service

All articles in this section (28): potok.now/golosovoy-vvod-dannye-privatnost-152-fz

How to use the section

The materials are meant for two different audiences. The first is an ordinary user for whom the question of privacy comes down to curiosity: where does voice go during dictation and is it worth worrying about in everyday correspondence.

The second is the person responsible for data in a company, who collects consents, keeps the register of operators and answers regulator requests. For this group the requirements of 152-FZ matter, covered with examples in the materials where voice goes during dictation and what 152-FZ has to do with it and the 152-FZ checklist for a law firm, if client data is your daily routine.

The difference shows in an example: if you dictated a personal letter to a friend, data localization does not concern you, since the law regulates organizations and not private correspondence. If you dictated the same thing into a CRM for work, it does concern you: the company acts as the operator of the client's personal data.

If you are not sure which audience is yours, start with the material where the data of voice input is physically stored: it answers the question in general terms, and then you can move on to narrower topics.

What Potok does not have

Potok has a mode that complies with 152-FZ and servers in Russia, but this does not make it a full legal compliance tool by itself: the service is responsible for where data is physically processed, while the duties of a personal data operator (collecting consents, keeping the register, answering data subjects' requests) remain with the company that uses the program. The full list of what to check before choosing a service is in the article voice input and personal data: what to check.

Potok is a cloud service: it does not work at all without the internet, and for tasks where audio in principle must not leave the computer (more in the material on voice input without the internet), the ordinary plan is not enough. A separate variant with servers inside the company perimeter is needed, and it is provided on request.

A separate category of data is biometric personal data: characteristics by which a person's identity can be established. A voiceprint, which in theory can be built from a recording of speech, formally falls into this category, although ordinary voice input does not create or store such prints: it turns speech into text and does not save data about the voice itself.

Frequently asked questions

Related software: terms compared

Built-in dictation and Potok

Primary sources: speakflow.ru · speakflow.ru · speakflow.ru · blog.speakflow.ru