A privacy investigation is underway at the University of Waterloo after students discovered that some vending machines on campus were using facial analysis software without their knowledge or consent.
Two complaints were filed with the Office of the Information and Privacy Commissioner of Ontario about the issue and requested the commissioner to look into whether the university violated any privacy laws.
The vending machines, which are made by a company called Invenda, are supposed to use the software to determine the age and gender of customers and tailor their product offerings accordingly.
However, students were not informed of this feature and only found out when one of the machines malfunctioned and displayed an error message that revealed the software’s name.
The former Privacy Commissioner of Ontario, Ann Cavoukian, who now leads the Global Privacy & Security by Design Centre, condemned the use of facial recognition technology without consent and warned of its potential risks to privacy and identity.
“This is completely unacceptable Who authorized the use of facial recognition in a vending machine, clearly without the consent of the individuals whose faces were being captured? The impact of this unauthorized access to such sensitive personal data is extensive, not only to privacy but extending to identity theft, etc,” Cavoukian told True North.
Invenda, on the other hand, defended its software and claimed that it complies with the European Union’s General Data Protection Regulation laws.
The company also said that it does not store or share any personal data from the customers and that it is transparent about its technology.
In response to the reports, the university has said that it has disabled the machines and will be replacing the units.
