Ruminations

How Sweet It Isn't

Today we’re going to be talking about vending machines. No, that’s not a metaphor or some typical James bait and switch. Vending machines.

The technology used in vending machines has advanced by leaps and bounds. Not that you could tell based on the vending machines we have here in the United States, which are nothing fancy. The vending machines in Europe are pretty impressive. But nothing compares to the vending machines in China were you can buy such a large variety of things and pay for them with your palm print.

Of course, if you’re not in good standing in China’s social credit system then you may not be able to buy ordinary things such as booking a flight or train ticket, let alone make purchases using these types of vending machines.

The specific vending machines we’re going to talk about today are in Ontario, Canada, though they are reportedly located throughout North America.

So, what’s so special about these vending machines? To put it simply, it’s what you’ll find inside them. Snacks? Soda? Cupcakes, Burgers or Crabs? No, not this time. What about candy? Yes, and no. What was discovered in these vending machines in University of Waterloo was facial recognition software. And M&M's.

The University of Waterloo’s mathNews school paper covered this in a recent edition. For a short news story about what they discovered you can check out this from CTV News in Canada.

Many students feel that this secretive use of facial recognition violated their privacy rights. One even asked, "Why do the stupid M&M machines have facial recognition?" Upon learning about the facial recognition software, University of Waterloo has asked the local distributor to remove all the vending machines from Invenda, the company that manufactures these machines. In the meantime, students have covered the cameras with post-it notes and even gum.

Invenda denied their facial recognition software is used to recognize or identify faces. They stated that it only detected foot traffic and does not collect or store any data or photos. This seems to conflict with their sales brochures which promise "the machines are capable of sending estimated ages and genders" of each user without requesting consent.

If the vending machines needed the facial recognition functionality to detect a customer, why do the machines still work with the peephole cameras covered?

A student commented in the CTV news story above that almost everyone who uses the machines are college students. So why do they need to try to use facial recognition to determine the age of the machine’s customers?

Invenda also claimed their machines were compliant with the EU’s GDPR and are in use in many facilities across North America. This is where North America becomes important, because GDPR is only applicable to business done in the European Union (with few exceptions).

GDPR is currently the world’s toughest data privacy law, with major restrictions and serious punitive measures to ensure compliance.

The facial recognition software was being used on anyone who used the vending machines, without obtaining explicit consent. With the GDPR considering facial images as amongst the most sensitive personal data, it’s difficult to see how Invenda's claims can be true.

Invenda's GDPR claims notwithstanding, they may in fact be violating Canadian privacy law. Canada's PIPEDA mandates obtaining the express opt-in consent of individuals with regard to collecting biometric information.

It's hard to see why facial recognition software was needed for simply detecting someone was trying to use the vending machine. Invenda's brochure tells us the software was used for more than Invenda is admitting. Simply displaying a notice on the screens that software was in use to gather demographic data about customers may have been enough to prevent such negative publicity.

As for me, I'm still going to be eating the leftover little bags of M&M's from Halloween this October. But I will wear a hat at the self-checkout register so the cameras can't see my face.

---