Vending machines at the University of Waterloo violated privacy act

Playing null of undefined

Smart vending machines violated privacy rights

Reaction to vending machine privacy ruling

Ontario’s privacy watchdog has ruled vending machines on campus at the University of Waterloo violated the Freedom of Information and Protection of Privacy Act.

Students lodged a formal complaint with the Office of the Information and Privacy Commissioner of Ontario (IPC) in Feb. 2024 after the ‘smart’ vending machines were installed by a third-party provider. They claimed the machines were using facial recognition technology to collect images without consent or notice.

The students said they were alarmed when one of the machines, located in the Modern Languages building, malfunctioned and displayed an error message reading, “Invenda.Vending.FacialRecognition.App.exe – Application Error.”

“We wouldn’t have known if it weren’t for the application error. There’s no warning here,” said River Stanley, a fourth-year student at UW, who investigated the machines for an article in the university publication, mathNEWS.

Stanley told CTV News students then started putting sticky tack, chewing gum, or Post It Notes over the machines’ sensors.

The investigation

An IPC investigator learned the university had signed an agreement with the company that owns the machines, Adaria, in Oct. 2023. Adaria was to provide 29 vending machines and be responsible for maintaining, monitoring and stocking them. They were installed in Dec. 2023 and removed from campus in Feb. 2024 when the school learned of the privacy concerns.

The university said Adaria either purchased or leased the machines from candy maker MARS and MARS contracted Invenda to build and supply the machines.

The school told the IPC it had no knowledge that facial detection technology was being used to collect demographic data.

According to an IPC report, when a sale was made, the machine would record a timestamp, the item purchased and demographic data, including facial detection. The technology would then estimate the buyer’s gender and age range.

“There was no dispute that the IVMs [Intelligent Vending Machines] captured video images of individuals’ faces on the university’s campus,” the report read. “However, the university argued that the resolution of the optical sensor in the IVMs was too low for the device to be considered a camera or create identifiable images of individuals.”

The IPC said an investigator deemed the images were of ‘photographic quality’ but noted those images were held for milliseconds before they were converted into abstract grayscale images and then into numeric descriptors describing the demographic data.

“Our investigation into this matter has found no evidence to suggest that personal information, beyond the initial temporary capture of facial images, was retained and further used by these vendors,” the report said.

Did the university know?

The IPC report noted the agreement between the University of Waterloo and the vending machine company contained “all the appropriate standard clauses necessary to protect personal information.”

It also determined the university was not aware the machines had facial detection technology that was collecting personal information and had not asked for vending machines with that capability.

However, Adaria’s proposal did mention a collaboration with MARS to test new product innovations, including MARS Intelligent Vending Machines.

The investigators stated that, although the university had reasonable contractual measures in place, it failed to carry out the necessary due diligence that would have uncovered the potential privacy concerns.

Report recommendations

The IPC report concluded with two recommendations: the university should review its privacy policies to ensure any future collection of personal information complies with the Freedom of Information and Protection of Privacy Act, and the university should ensure it carries out all necessary due diligence to identify, assess and mitigate any potential risks to personal information when entering into new agreements with third-party providers.

Stanley’s Response

“That’s incredible that our advocacy has actually paid off in this way. Not only were the machines removed, but then also we are certain that there was a wrong done here, and so it should not be repeated in the future,” Stanley told CTV News on Monday.

While proud the story led to a report from the privacy commissioner, Stanley said all sorts of students from other Ontario universities emailed mathNews about similar machines on their campuses. Stanley feels the report doesn’t give enough blame to the entities involved beyond the University of Waterloo.

“The report only goes after the university. Maybe that’s just the nature of the report, that there was a complaint made against the university. So, it falls on the university. Okay. But at the same time, there are other entities in this transaction that seem to have escaped blame,” Stanley said.

Now with evidence that there was a wrong done, Stanley said it can help to advocate for not just students’ privacy, but Canadians privacy elsewhere. Stanley feels like the ruling falls a little bit short.

“Our privacy laws are somewhat toothless. It doesn’t seem like they do much. We have these regulations. We have these protections in place, but without any actual response when those protections are violated, how protected are we really?” Stanley said.

MARS, Invenda and Adaria did not respond to CTV’s request for a comment on Monday. The Privacy Commissioner is expected to speak with CTV News on Tuesday.