University vending machine error reveals use of secret facial recognition | A malfunctioning vending machine at a Canadian university has inadvertently revealed that a number of them have been usin…::Snack dispenser at University of Waterloo shows facial recognition message on screen despite no prior indication
The worst part of all is that no one would think of the fact that a vending machine is performing facial recognition techniques, because in general it is assumed that a vending machine is a mechanical device, as it has been in the past. There is not any user benefit in that.
I researched the manufacuter and in their brochure (see page 6) of a similar vending machine it is revealed what data can be processed:
Among the worst data sets are:
Bonus: on page 7 of the product brochure they introduce an app which allows the customer to make purchases directly from their smatphone, with features like
“What do customers get?”
Finally! I always thought that payment is not fun enough. What a time to be alive.
The etc. is doing a lot of work there
Well this absolutely wouldn’t fly in the EU with GDPR
Can you lot in the states do something about your weird corpocracy, it’s looking a bit dystopian
Bad news, the manufacturer is located in Switzerland and, as stated in the brochure, they advertise their product as “Made in EU”. Probably to implicate that any data which will be collected and processed will be under the terms of GDPR.
I haven’t looked up the terms regarding GDPR, but I assume that their data collection is somewhat “compliant” with GDPR, which does not necessaryly mean anything. It can just mean that data is not stored locally, albeit it will be send to the manufacturer (but probably entcrypted). However, under GDPR you can enforce your right of deletion of the collected data - that is, if you know that data about you has been collected.
What makes this issue so severe is that it would have never been detected that data has been collected and processed, if it weren’t for a malfunction.
Edit: grammar, spelling
Switzerland is not in the EU. Also even if it was, it’s not illegal to design/manufacture solutions that don’t comply with GDPR. They just can’t be sold in the EU.
Also, data collection absolutely requires consent, it’s why cookie popups exist on every website.
No. But also, this is Ontario, well-known for being outside US jurisdiction.
Scariest part is we’d never have known if the facial recognition software hadn’t encountered an error. At least until someone curious enough looked up the machine.
This reminds me of the bit in Minority Report where Tom Cruise has to get his eyes surgically replaced so the shopping centre kiosks can’t track him