Ontario's privacy commissioner is looking into a southwestern university's campus-wide installation of more than two dozen vending machines that came equipped with facial analysis technology – a situation that drew concerns from students earlier this month.
The Office of the Information and Privacy Commissioner of Ontario said it has received two complaints on the matter at the University of Waterloo.
"Given that we have open files on this matter, we cannot provide additional details at this time," it wrote in a statement.
"However, until we have examined the circumstances, we urge all public institutions that are using, or contemplating using, these machines, to ensure that they comply with (privacy laws) regarding the collection, use, and disclosure of any personal information."
Abiding by privacy laws is a legal obligation, the commissioner's office said, as well as "a commitment to safeguarding the personal information of Ontarians and ultimately maintaining their trust in public institutions."
The University of Waterloo has said it was unaware of the technology in the machines.
It is getting all 29 vending machines, which were recently installed, removed from campus.
"The majority will be removed by the end of this week, with the remainder being removed by the end of next week," university spokeswoman Rebecca Elming said in an email Thursday.
"All of these machines have been unplugged."
The school said it began looking into student concerns after someone posted a photo online this month of a vending machine displaying an error message apparently related to a facial technology program.
A student publication, MathNews, reported on the issue about a week after the online post, stressing the need for "meaningful consent" when such technologies are used.
Vending machine operator, Adaria Vending Services, did not immediately respond to a request for comment on Thursday.
The software developer of the technology involved, Invenda, said the machines use people detection and facial analysis – not facial recognition – technology with motion sensors that let the machine know when to activate screens for purchases.
"People detection solely identifies the presence of individuals whereas, facial recognition goes further to discern and specify individual persons," the company wrote in a statement.
"Invenda operates under strict policy and does not collect any user data or photos, ensuring individual identification via machine technology is unattainable."
The company said the technology "can only determine if an anonymous individual faces the device, for what duration, and approximates basic demographic attributes unidentifiably."
"Data acquisition is limited to assessing foot traffic at the vending machine and transactional conversion rates," it said. "These systems ... refrain expressly from managing, retaining, or processing any personally identifiable information."
Adaria said on its website that its vending machines are connected to the internet and have built-in cloud connectivity.
That "enables us to obtain detailed data and analytics from sales and provides us the ability to optimize your machines to ensure they have the proper products to maximize sales and end user satisfaction," it said, adding that its vending machines "are utilized at some of the busiest facilities in Canada."
The Office of the Privacy Commissioner of Canada said earlier this week it was aware of the issue at the University of Waterloo and called it "concerning."
"Given the increased prevalence of public and private-sector organizations using facial recognition technology, the broader issues are also of significant interest to the OPC," spokesperson Vito Pilieci said in an email.
This report by The Canadian Press was first published Feb. 29, 2024.
Fakiha Baig, The Canadian Press
