A southwestern Ontario university will be getting rid of more than two dozen vending machines after students raised concerns about facial recognition technology.
The University of Waterloo said Tuesday that it began looking into the issue after seeing students flag it on social media.
The university added it was unaware of the technology and has asked that it be disabled until the 29 machines, which were recently installed across campus, are removed.
In a written statement, university spokesperson Rebecca Elming thanked students for bringing the issue to the school’s attention and said the university has asked that the machines be removed from campus “as soon as possible.”
Neither the company behind the machines, Invenda, nor their operator immediately responded to a request for comment.
The Office of the Privacy Commissioner of Canada said it was aware of the issue and called it “concerning.”
“Given the increased prevalence of public and private-sector organizations using facial recognition technology, the broader issues are also of significant interest to the OPC,” spokesperson Vito Pilieci said in an email.
He said the privacy commissioner’s office has not received a formal complaint about the machines, but is looking into the matter “to better understand the practices and the parties involved, with a view to determining next steps.”
The issue was flagged by students on a Reddit forum earlier this month, when someone posted a photo of one of the machines displaying an error message apparently related to a facial recognition program.
An article on the topic was published in a student publication about a week later, stressing the need for “express, meaningful consent” when such technologies are used.
The machines’ operator, Adaria Vending Services, told the publication MathNews the technology acts as a motion sensor to know when to activate the screen for purchases.
Invenda, meanwhile, told the publication the machines don’t engage in “storage, communication, or transmission of any imagery or personally identifiable information.”
The article notes, however, that a FAQ from Invenda says “only the final data, namely presence of person, estimated age and estimated gender, is collected without any association with an individual.”