UW vending machines with face detection tech violated privacy rights, says Ontario watchdog
An investigation by the privacy commissioner found flaws in the university’s tendering and procurement process
Vending machines that used face detection technology to track information about users on the University of Waterloo campus breached privacy rights.
That's according to the latest report from the office of the Information and Privacy Commissioner (IPC) of Ontario.
In February 2024, the university removed 29 vending machines that were tracking the age and gender of customers without their knowledge or consent. The move came after opposition from University of Waterloo students, who became aware of the technology after a Reddit user spotted an on-screen error message on one of the machines, which indicated an apparent problem with its facial recognition program.
Invenda, the Switzerland-based manufacturer of the vending machines, told CBC at the time the machines use facial analysis, not facial recognition, software, and that it isn't storing data or photos. The company says its technology is mainly used to tell when a person is standing in front of a vending machine, and to change the screen from "standby" mode, which shows ads, to "sales" mode, which shows different products.
University's procurement process at fault
The report from the IPC, release Monday, said due diligence is important when installing smart tech.
"The machines used cameras to capture identifiable facial images, resulting in an unauthorized collection of personal information and a privacy breach ... The collection occurred without proper notice to individuals," the IPC report said, adding that the university was unaware of the face-detection software when they were purchased.
"These issues resulted from flaws in the university's tendering and procurement process... which failed to apply the necessary level of due diligence by conducting a privacy impact assessment, or requiring prospective service providers to do so, in order to identify and assess the privacy implications of the technology."
Debate over image quality
The report says the university did not dispute that the machines were capturing images of individuals faces on campus, but it did argue that "the resolution of the optical sensor in the [Intelligent Vending Machines] was too low for the device to be considered a camera or create identifiable images of individuals".
Dr. John Gayle, the investigator who penned the report, disagreed with the university's position.
"The university did not provide any evidence to support its position," Gayle said, adding that the materials provided by the university itself describes facial recognition software as a "webcam" that can detect the presence of human faces and optionally assign tags determining the person's gender or age.
"The university has advised that the optical sensors in the [vending machines] had resolution of either 1280x720 or 640x480," he said, pointing out that image quality is enough to "capture identifiable images ... within sufficient proximity."
The IPC says following its investigation, the university confirmed that it is no longer using the vending machines on campus.
ABOUT THE AUTHOR
With files from Paula Duhatschek