this post was submitted on 24 Feb 2024
373 points (100.0% liked)

Technology

69999 readers
4970 users here now

This is a most excellent place for technology news and articles.


Our Rules


  1. Follow the lemmy.world rules.
  2. Only tech related news or articles.
  3. Be excellent to each other!
  4. Mod approved content bots can post up to 10 articles per day.
  5. Threads asking for personal tech support may be deleted.
  6. Politics threads may be removed.
  7. No memes allowed as posts, OK to post as comments.
  8. Only approved bots from the list below, this includes using AI responses and summaries. To ask if your bot can be added please contact a mod.
  9. Check for duplicates before posting, duplicates may be removed
  10. Accounts 7 days and younger will have their posts automatically removed.

Approved Bots


founded 2 years ago
MODERATORS
 

University vending machine error reveals use of secret facial recognition | A malfunctioning vending machine at a Canadian university has inadvertently revealed that a number of them have been usin...::Snack dispenser at University of Waterloo shows facial recognition message on screen despite no prior indication

top 50 comments
sorted by: hot top controversial new old
[–] [email protected] 84 points 1 year ago (4 children)

The worst part of all is that no one would think of the fact that a vending machine is performing facial recognition techniques, because in general it is assumed that a vending machine is a mechanical device, as it has been in the past. There is not any user benefit in that.

I researched the manufacuter and in their brochure (see page 6) of a similar vending machine it is revealed what data can be processed:

Among the worst data sets are:

  • product demographics
  • measuring of foot traffic
  • gender/ age/ etc.

Bonus: on page 7 of the product brochure they introduce an app which allows the customer to make purchases directly from their smatphone, with features like

  • consumer engagement through gamification, interactive marketing, gifting, scratch-and-win receipts, product sampling and cross selling

"What do customers get?"

  • a fun and engaging payment process

Finally! I always thought that payment is not fun enough. What a time to be alive.

[–] [email protected] 23 points 1 year ago

gender/age/etc.

The etc. is doing a lot of work there

[–] [email protected] 17 points 1 year ago (2 children)

Well this absolutely wouldn't fly in the EU with GDPR

Can you lot in the states do something about your weird corpocracy, it's looking a bit dystopian

[–] [email protected] 11 points 1 year ago* (last edited 1 year ago) (3 children)

Bad news, the manufacturer is located in Switzerland and, as stated in the brochure, they advertise their product as "Made in EU". Probably to implicate that any data which will be collected and processed will be under the terms of GDPR.

I haven't looked up the terms regarding GDPR, but I assume that their data collection is somewhat "compliant" with GDPR, which does not necessaryly mean anything. It can just mean that data is not stored locally, albeit it will be send to the manufacturer (but probably entcrypted). However, under GDPR you can enforce your right of deletion of the collected data - that is, if you know that data about you has been collected.

What makes this issue so severe is that it would have never been detected that data has been collected and processed, if it weren't for a malfunction.

Edit: grammar, spelling

[–] [email protected] 10 points 1 year ago (1 children)

Switzerland is not in the EU. Also even if it was, it's not illegal to design/manufacture solutions that don't comply with GDPR. They just can't be sold in the EU.

Also, data collection absolutely requires consent, it's why cookie popups exist on every website.

[–] [email protected] 5 points 1 year ago

That is correct. Switzerland is not a part of the European Union. The manufacturer, Invenda, is located in Switzerland. That is where their headquarters are. It might be possible that their vending machines are produced within the EU (another country where production costs are lower). It might be possible that these specific models (those who offer data collection) are designed for markets outside of EU.

They advertise their product as "Made in EU" (see brochure). This could be made on purpose to implicate that their data collection meets GDPR requirements, leading to believe that everything is compliant with the law.

load more comments (2 replies)
[–] [email protected] 8 points 1 year ago

No. But also, this is Ontario, well-known for being outside US jurisdiction.

[–] [email protected] 11 points 1 year ago

Scariest part is we'd never have known if the facial recognition software hadn't encountered an error. At least until someone curious enough looked up the machine.

[–] [email protected] 7 points 1 year ago

This reminds me of the bit in Minority Report where Tom Cruise has to get his eyes surgically replaced so the shopping centre kiosks can't track him

[–] [email protected] 16 points 1 year ago* (last edited 1 year ago)

AND they might have had miniature cameras in them for the past 20 years.

(The laws against this stuff are almost non-existing. Option left for those of us creeped out by constant surveillance: don't leave home, unplug that webcam. Demand privacy or lose it.)

[–] [email protected] 15 points 1 year ago

Hey hey - y'all quit hanging around the vending machines! You're going to be late for the two minutes of hate!

[–] [email protected] 14 points 1 year ago

This is the best summary I could come up with:


A malfunctioning vending machine at a Canadian university has inadvertently revealed that a number of them have been using facial recognition technology in secret.

Invenda, the company that produces the machines, advertises its use of “demographic detection software”, which it says can determine gender and age of customers.

It claims the technology is compliant with GDPR, the European Union’s privacy standards, but it is unclear whether it meets Canadian equivalents.

In April, the national retailer Canadian Tire ran afoul of privacy laws in British Columbia after it used facial recognition technology without notifying customers.

The government’s privacy commissioner said that even if the stores had obtained permission, the company failed to show a reasonable purpose for collecting facial information.

The University of Waterloo pledged in a statement to remove the Invenda machines “as soon as possible”, and that in the interim, it had “asked that the software be disabled”.


The original article contains 258 words, the summary contains 149 words. Saved 42%. I'm a bot and I'm open source!

[–] [email protected] 7 points 1 year ago (10 children)

This seems like an over reaction by people who don't understand the technology or associated risks. Focus on the implementation not the tech. There is no indication that the vending machine is inappropriatly storing or transmitting personally identifiable information or that its making decisions based on biased data.

[–] [email protected] 66 points 1 year ago (6 children)

Mind explaining to me why a vending machine needs to know the demographics of its users?

[–] [email protected] 4 points 1 year ago* (last edited 1 year ago) (2 children)

I guess to collect data for advertisements and product development

[–] [email protected] 29 points 1 year ago (1 children)

It's installed at a university. Seems like you could make a pretty fucking good guess on the demographics of customers just based on that fact.

[–] [email protected] 5 points 1 year ago

Best answer

[–] [email protected] 9 points 1 year ago (1 children)

Do you see a lot of advertising for vending machines?

load more comments (1 replies)
load more comments (5 replies)
[–] [email protected] 41 points 1 year ago (1 children)

Hahahahahahahahahahahahajaja

Total "trust me bro" take.

I have the keys to your house, but there's no evidence I'm using them inappropriately.

I never say this, but go lick some more boot.

[–] [email protected] 4 points 1 year ago

You obviously don't work in tech in Canada. Do a tiny bit of some research before generating strong opinions

[–] [email protected] 28 points 1 year ago (4 children)

This is a pretty "generous" take. I ask you then: if the company isn't doing communicating any of the scans/recordings, what is the purpose of the technology being installed in the first place?

[–] [email protected] 8 points 1 year ago (4 children)

Cameras are one thing.

But if you can actually process it, that's a meaningful cost per unit. The only reason you do that is if you're planning to use it.

load more comments (4 replies)
load more comments (3 replies)
[–] [email protected] 21 points 1 year ago (4 children)

I'm baffled how a genuine human being could feel this way

[–] [email protected] 5 points 1 year ago

on the internet nobody knows you're a bot (or damage control PR shill)

load more comments (3 replies)
[–] [email protected] 17 points 1 year ago

There is no indication that the vending machine is inappropriatly storing or transmitting personally identifiable information or that its making decisions based on biased data.

And until the machine malfunctioned, there was no indication that the vending machine was collecting any data at all. Businesses can say whatever they want in the court of public opinion, but until these same claims are made in a court of law they should be considered lies to placate the public.

Furthermore, why even collect such data if it's not meant to be utilized? They already know what the most popular products are (since they know what they restock the most) so for what reason do they need to collect demographics?

[–] [email protected] 8 points 1 year ago (1 children)

Says a guy who doesn't hide his real name, face, and location for his online persona. You have no concept of digital privacy.

[–] [email protected] 3 points 1 year ago (1 children)

Arguing that I have no concept of digital privacy because I choose to share my name and face is an ignorant statement and demonstrates how little you understand the concept of online privacy. For context, I work in tech in Canada, I deal with GDPR and other compliances. I understand the technology, the risks, and the attack vectors. These vending machines are not a serious threat to individuals privacy. Facebook, Google, Amazon, are serious threats. Focus your energy on the actual risks instead of making uninformed comments.

[–] [email protected] 6 points 1 year ago (1 children)

Did 2yo Marisol also make an informed choice to share her identity and location on the fediverse?

This vending machine is taking biometrics off of everyone who walks past it and you don't think that's the least bit concerning?

GDPR doesn't apply in Canada unless you are trying to operate business in Europe.

Compliance only matters if you can't afford a fine. If you can make more money violating regulations than the cost of the fine, it's just a business expense.

load more comments (1 replies)
[–] [email protected] 7 points 1 year ago (1 children)

This is the first step to charging a different price based on demographic.

[–] [email protected] 3 points 1 year ago (2 children)

The Canadian Human Rights Act protects Canadians from discrimination based on race, national or ethnic origin, colour, religion, age, sex, sexual orientation, gender identity or expression, marital status, family status, genetic characteristics, disability etc.

[–] [email protected] 5 points 1 year ago
load more comments (1 replies)
[–] [email protected] 5 points 1 year ago

Go back to reddit Greg.

[–] [email protected] 5 points 1 year ago (2 children)

Yikes, people here are brutal to people with differing viewpoints, heh.

Doesn't seem to matter how knowledgeable in the subject matter the person may be either.

¯\_(ツ)_/¯

load more comments (2 replies)
load more comments
view more: next ›