Canada-based University of Waterloo is rushing to remove its M&M-branded smart vending machines from campus after outraged students discovered that they were secretly collecting facial recognition data without their consent.
The scandal began when a student, using the alias SquidKid47, posted an image on Reddit showing the error message “Invenda.Vending.FacialRecognitionApp.exe” from a vending machine on campus. This vending machine appeared after it failed to launch a facial recognition application that no one expected to be involved. The process of using a vending machine.
“Hey, so why does that stupid M&M machine have facial recognition?” thought SquidKid47.
The Reddit post sparked an investigation by River Stanley, a fourth-year student who was writing for a university publication called MathNEWS.
Mr Stanley raised the alarm after reviewing an Invenda sales brochure that promised to “transmit an estimated age and gender” of anyone using the machine, without asking for consent.
Frustrated by this, Stanley said years ago that the Privacy Commissioner of Canada found that some shopping mall information kiosks were secretly “using facial recognition software on unsuspecting customers.” After making the discovery, I learned that they were investigating a shopping mall operator called Cadillac Fairview.
Thanks to this official investigation, Canadians now know that “more than five million non-consenting Canadians” have been scanned into Cadillac Fairview's database, Stanley reported. Although Cadillac Fairview was ultimately forced to delete its entire database, Stanley said he is concerned about the consequences if Invenda customers like Mars collect similarly sensitive facial recognition data without their consent. He writes that it remains unclear.
Stanley's report ended with a call for students to ask universities to “remove facial recognition vending machines from campus.”
University of Waterloo spokeswoman Rebecca Elming eventually responded, confirming to CTV News that the school had asked for the vending machine's software to be disabled until the machine was removed.
Students told CTV News that the controversy has shaken their trust in the university's administration. Some students claimed on Reddit that they tried to hide the vending machine's camera using gum and post-it notes while waiting for a response from the school. One student wondered, “Where else on campus could we use this technology?”
Elming could not confirm exactly when the machines would be removed, only telling Ars it would be removed “as soon as possible.” Elming declined Ars' request to reveal whether there are other areas of campus where facial recognition data is being collected. She also told those who enjoy snacks on campus when students would expect vending machines to be replaced with snack dispensers that do not have surveillance cameras. I didn't.
Invenda claims machines are GDPR compliant
The MathNEWS study tracked responses from companies responsible for smart vending machines on the University of Waterloo campus.
“The most important thing to understand is that machines do not take or store photos or images, and machine technology cannot be used to identify individuals,” Adaria Vending Services told MathNEWS. The technology works as a motion sensor that detects faces, so the machine knows when to activate the purchasing interface and does not take or save an image of the customer. ”
Adaria and Invenda say students don't have to worry about data privacy as their vending machines are “fully compliant” with the European Union's General Data Protection Regulation (GDPR), the world's strictest data privacy law .
“These machines are fully GDPR compliant and are used in many facilities across North America,” Adaria's statement said. “At the University of Waterloo, Adaria manages the last-mile fulfillment service and is responsible for the replenishment and logistics of snack vending machines. Adaria does not collect data about users and these M&M vending machines We also do not have access to identify the user of the machine.”
