Privacy commissioner says smart vending machines went ‘over and above what you needed to sell snacks'
Ontario's privacy watchdog is sharing new insight on the investigation into the so-called smart vending machines that collected the personal data of users at the University of Waterloo.
'[They] went over and above what you needed to sell snacks,' the privacy commissioner told CTV News.
Those machines should have never been installed, she said, if the school had followed proper procedures.
History of the case
Students were alarmed last year when they saw an error message displayed on a machine in the Modern Languages building that read: 'Invenda.Vending.FacialRecognition.App.exe – Application Error.'
vending machine facial recognition
A vending machine at University of Waterloo displays a facial recognition app error. (Reddit)
They filed a formal complaint with the Office of the Information and Privacy Commissioner of Ontario (IPC) in Feb. 2024, alleging the vending machines were using facial recognition technology to collect images without their consent.
The ensuing investigation determined the university had signed an agreement with Adaria to provide, maintain, monitor and stock the vending machines in Oct. 2023. The University of Waterloo told the IPC that Adaria had purchased or leased the machines from candymaker MARS and MARS contracted another company, Invenda to build and supply the machines.
smart intelligent vending machine uw university of waterloo
Intelligent Vending Machine (IVM) at the University of Waterloo. (Colton Wiens/CTV News)
The school insisted they were not aware they contained facial recognition technology, and the machines were removed from campus when they learned about the students' concerns.
smart intelligent vending machine uw university of waterloo
Intelligent Vending Machines (IVMs) after being removed from the University of Waterloo. (Source: UW)
According to IPC's report, the vending machines recorded purchase and demographic data.
'There was no dispute that the IVMs [Intelligent Vending Machines] captured video images of individuals' faces on the university's campus,' the report read. 'However, the university argued that the resolution of the optical sensor in the IVMs was too low for the device to be considered a camera or create identifiable images of individuals.'
The investigator noted the images were of 'photographic quality' but were only held for milliseconds before being converted into grayscale images and numeric descriptors.
facial recognition
An example of the photos taken by facial recognition software (left) and conversion into grayscale images (right). (Source: Canadian Legal Information Institute)
'Our investigation into this matter has found no evidence to suggest that personal information, beyond the initial temporary capture of facial images, was retained and further used by these vendors,' the report said.
The IPC ruled the university violated the Freedom of Information and Protection of Privacy Act, as it failed to do its due diligence to identify potential risks.
More from the investigation
Ontario's privacy commissioner spoke exclusively with CTV News about the investigation.
Patricia Kosseim said the 'over-collection' of personal information was concerning.
'There were other optional features that, to our knowledge, we did not find were turned on in this case,' she said. 'These machines could also detect student's moods, from very happy to very sad, and facial features like a beard or a mustache, or if somebody was wearing sunglasses or not.'
vending machine facial recognition
Fourth-year University of Waterloo student River Stanley explains where students have been trying to cover a hole on a vending machine that they believe houses a camera. (Colton Wiens/CTV Kitchener)
The University of Waterloo, the privacy commissioner added, was not the only school to use the vending machines.
'We've gotten a lot of emails from people that have seen them all over the province.'
vending machine facial recognition
Students believe there is a camera inside this hole on the vending machine. (Colton Wiens/CTV Kitchener)
For Kosseim, the problem started before the contract was signed for the smart vending machines.
'Had they had proper due diligence in the course of their procurement practice… they would have probably twigged onto the fact that there was technology behind them, smart technology, that should have prompted the university to conduct a privacy impact assessment and then, unpack all of these features which would have given them the choice, the option to say, 'No, you can't do this,'' she explained. 'Then they would have seen that there were quite significant risks and… either mitigated the risks by not turning on those features or maybe going with another vendor altogether and avoiding all these problems.'
Public institutions in Ontario have limitations on what personal information they can collect.
'They can only do it for a lawfully authorized activity,' Kosseim said. 'Universities are allowed to have cafeteria services and vending machines and provide food for its students on campus, and to collect payment information to pay for those services. But they were not lawfully authorized to go beyond that and collect all this additional information, which was not necessary for the purpose of buying a can of Coke or a bag of chips. That's where the law really draws the line in Ontario for public institutions.'
She said the IPC's investigation should serve as a warning to other schools.
'Despite the best intentions, and sometimes unbeknownst to the institution itself, there could be these technologies in the background, in the dark so to speak, which really undermine students' trust or public trust more generally,' Kosseim explained. 'One of our strong recommendations to the institution, the university, going forward was to follow that guidance in the future so that similar oversights won't happen again.'
Changes to privacy rules
The investigation by the IPC only focused on what the university should have done to avoid potential privacy problems.
'We did not investigate the vending machine manufacturer or the provider or supplier,' Kosseim said. 'Those commercial activities fall under the jurisdiction of the federal commission.'
The IPC also does not have the ability to do anything more than provide recommendations.
That will change, however, on July 1.
'I'll have the ability, the authority, to exchange information with my federal counterparts or, in fact, any of my provincial or territorial counterparts,' Kosseim explained, adding that the federal commission could then investigate commercial or third-party vendors. 'A joint investigation can come up with consistent findings and work together, which is good for the institution as well.'
The privacy commissioner can also go beyond recommendations.
'There are provisions that will come into force that will allow my office to conduct investigations with quite extensive investigative powers,' said Kosseim. 'And the power to issue binding orders, including to order institutions to stop certain practices or to change their practice, or to modify [their practice].'
Institutions will also be required to do more due diligence.
'They will have to conduct privacy impact assessments… before collecting personal information or before making significant changes, to the purpose for which they will use or disclose that personal information,' Kosseim said. '[They] have an obligation to notify the students in this case, or the public or citizens or users of government services, of these collection practices and of these technologies. So, there is a positive obligation on institutions to provide public notice of what they're doing and explain the information practice.'
The smart vending machine investigation is one of the last she will participate in before the new rules go into effect.
Kosseim also praised those who first raised privacy concerns, saying they should be 'proud' of their efforts in this case.
'I want to just highlight how fortunate we were that the students brought this issue to our attention,' she said. 'That kind of proactivity on the part of everyday Ontarians is really important, to stand up for the rights of everybody.'
MARS, Invenda and Adaria did not respond to requests for comment from CTV News.
- With reporting from Colton Wiens
Hashtags
Try Our AI Features
Explore what Daily8 AI can do for you:
Comments
No comments yet...
Related Articles
Globe and Mail
38 minutes ago
- Globe and Mail
House approves Bill C-5 to fast-track projects, Carney pledges summer consultations with Indigenous leaders
The House of Commons approved the government's legislation to fast-track big projects Friday before breaking for summer, wrapping up a brief but hectic four-week sitting. Prime Minister Mark Carney marked the event with an evening news conference alongside Indigenous Services Minister Mandy Gull-Masty and other MPs, where he vowed to address Indigenous concerns that the bill would allow Ottawa to override their rights. Mr. Carney laid out a plan for formal summits with Indigenous leaders over the summer to work out the details of how the new project regime will work. He also acknowledged that his government could have done a better job of explaining how the process will ensure Indigenous rights are protected. 'Being a reliable partner to Indigenous peoples is not just about upholding the duty to consult. It's about enabling the creation of long-term wealth and prosperity for Indigenous peoples through full equity ownership,' he said. Carney responds to Indigenous criticism of Bill C-5, says consultation is 'at the heart' of legislation Bill C-5 contains a section that aims to eliminate federal barriers to interprovincial trade and a section that allows the government to list specific large projects as national priorities and then exempt them from various legal requirements to speed up approvals. Mr. Carney said the plan was a central plank of the Liberal platform and pledged that it will be 'the most important economic initiative this country has seen for a long time.' Ms. Gull-Masty, the first Indigenous person to serve as Indigenous Services Minister, said the bill lays out a plan to co-develop projects with Indigenous communities. 'Now the real work begins,' she said. The House of Commons is not scheduled to resume sitting until Sept. 15. But the Indigenous consultations on C-5 are just one of many policy files that will continue to play out over the summer. Canada's 45th Parliament kicked off just a month after the April 28 federal election that returned the Liberals to power with another minority government, this time under Mr. Carney, the party's new leader. Trade tensions with the United States dominated Canadian political debate during the election campaign and that has carried through the early days of the Carney government. Chartrand on Bill C-5: 'We do have to have consent from Indigenous rights holders' The Prime Minister and U.S. President Donald Trump set a 30-day deadline at this week's Group of Seven summit in Kananaskis, Alta., to reach a deal aimed at resolving trade issues between the two countries. Mr. Carney leaves Sunday for Brussels and then The Hague for meetings of the Canada-European Union summit and the North Atlantic Treaty Organization summit. In an interview Friday in Parliament's West Block, Government House Leader Steven MacKinnon said Canadians should not expect Mr. Carney's pace to slow down during the summer. 'I think that we have a Prime Minister who very much is going to be a 365-day-a-year leader of this country,' he said. Further, he said the sheer number of outside issues that require attention, such as recent developments in the Middle East or wildfires across the country, means there is no slow period in government. 'The pace of events when one is in public life today is beyond dizzying,' he said. In addition to negotiating defence issues with the Europeans and trade matters with Mr. Trump, Mr. Carney's pledge to release a 2025 budget shortly after Parliament resumes means the traditional prebudget lobbying and consultation will run through the summer. Explainer: What federal Bill C-5, the One Canadian Economy Act, is all about Mr. MacKinnon boasted that the Liberals accomplished a lot in a short period, listing the adoption of tax cuts, billions of dollars more for the military and the passing of Bill C-5. In addition to C-5, the House of Commons adopted two bills related to approving government spending. However, other legislation related to border security and tax cuts did not get through the House. Both bills contain elements that are drawing strong criticism from privacy advocates. The tax measures, including an income-tax cut and removing the federal fuel charge, can still go ahead, however, because they were approved in an earlier vote. The government treats tax changes as if they are in place once legislation has received an initial vote of support. Bill C-5 is widely expected to be approved by the Senate next week. Conservative House Leader Andrew Scheer said Mr. Carney has not delivered on his campaign pledges to curb government spending, which is why his party voted against two spending bills this week. 'Maybe he gets some points for new rhetoric, but so far, it's pretty much the same Liberal approach on borrowing, spending, talking down our energy sector, refusing to commit to new big energy projects and defending the Liberal crime policies,' he said in an interview Friday. 'Nothing's off the table': AFN warns of potential legal action if Bill C-5 passes The Conservatives supported C-5 and Mr. Scheer said the party will continue to vote in favour of measures if they involve lower taxes or improving the economy. 'If the government is serious about meeting those objectives, we work with them. And if they don't, then we oppose,' he said. Bloc Québécois Leader Yves-François Blanchet predicted this week that when the Conservatives return in the fall, after party leader Pierre Poilievre is expected to regain a seat via a summer by-election, the party will be less likely to support the Liberals in the House. 'At a certain point, the Conservatives will return to being Conservatives,' he said at a news conference Wednesday, adding that the Liberals will then be more dependent on Bloc support. NDP interim leader Don Davies said that the Liberals under Mr. Carney are adopting more conservative policies. 'So far, I think the empirical evidence from the Carney government is absolutely that they're a right of centre government,' he said in an interview Friday. 'I mean, the first three things that Mr. Carney did was he ripped three policies directly out of the Conservative playbook. He cancelled the carbon tax, he cancelled the capital-gains inclusion policy and he indicated he was going to cut public service jobs,' he said. Having been reduced to just seven seats in the April election, the NDP no longer has party status and is not invited to the weekly meetings of House leaders that sets the parliamentary agenda. Nonetheless, Mr. Davies said his party has been effective at securing amendments to government legislation and bringing public attention to issues such as wildfires in Western Canada.
Globe and Mail
38 minutes ago
- Globe and Mail
Jane Silverstone Segal Increases Number of Shares of DAVIDsTEA Inc. Under Her Control
MONTREAL, June 20, 2025 (GLOBE NEWSWIRE) -- Jane Silverstone Segal, Chair of the Board of Directors of DAVIDsTEA Inc. (' DAVIDsTEA ') (TSXV: DTEA), announces that on June 20, 2025, she received shares of Rainy Day Investments Ltd. (' RDI ') by way of bequest from her late husband Mr. Herschel Segal, as a result of which Jane Silverstone Segal has voting control of RDI. RDI owns 12,012,538 common shares of DAVIDsTEA, representing 44.51% of DAVIDsTEA's issued and outstanding common shares, which shares are now controlled by Jane Silverstone Segal. Immediately prior to the transfer of shares described above, Jane Silverstone Segal held 127,087 common shares of DAVIDsTEA, representing 0.47% of its 26,985,738 issued and outstanding common shares. Immediately after the transfer of shares described above, Mrs. Segal holds or exercises control, directly or indirectly, over 12,139,625 common shares, representing 44.99% of DAVIDsTEA's issued and outstanding common shares. As a result of the transfer of shares described above, Mrs. Segal's holdings of DAVIDsTEA's common shares increased to 44.99% from 0.47%. The late Mr. Herschel Segal also held 1,523 common shares of DAVIDsTEA directly, representing 0.006% of the issued and outstanding shares. The 1,523 shares will be transferred to Jane Silverstone Segal by way of bequest in due course, following which she will hold or exercise control, directly or indirectly, over 12,141,148 common shares, representing 44.99% of DAVIDsTEA's issued and outstanding common shares. In accordance with applicable securities laws, Mrs. Segal may, from time to time and at any time, acquire additional DAVIDsTEA shares and/or other equity, debt or other securities or instruments (collectively, ' Securities ') of DAVIDsTEA in the open market or otherwise, and Mrs. Segal reserves the right to dispose of any or all of her Securities in the open market or otherwise at any time and from time to time, and to engage in similar transactions with respect to the Securities, the whole depending on market conditions, the business and prospects of the DAVIDsTEA and other relevant factors. A copy of an early warning report filed by Jane Silverstone Segal in connection with the transfer described above is available on SEDAR+ under DAVIDsTEA's profile. This news release is issued under the early warning provisions of Canadian securities legislation.
Globe and Mail
39 minutes ago
- Globe and Mail
enCore Energy Announces Filing of Early Warning Report
DALLAS , June 20, 2025 /CNW/ - enCore Energy Corp. (NASDAQ: EU) (TSXV: EU) (the "Company" or "enCore"), America's Clean Energy Company ™, announces that it has disposed of 170,000,000 common shares in the capital of Anfield Energy Inc. (" Anfield") (TSX.V: AEC; OTCQB: ANLDF; FRANKFURT : 0AD) in a private agreement at a price of $0.115 per share for aggregate proceeds of $19,550 ,000 (Canadian dollars). Immediately following the disposition, enCore holds or controls no common shares of Anfield. The disposition represents a 14.73% decrease in enCore's ownership or control over the outstanding common shares of Anfield on an undiluted basis. enCore does not currently hold or control any securities of Anfield . Since enCore's last early warning report dated January 15, 2024 , enCore's holdings have decreased by an approximate 16.02% of the outstanding common shares of Anfield on an undiluted basis. enCore disposed of the shares of Anfield in a private transaction. enCore may, depending on market and other conditions, increase beneficial ownership of the Company's securities, whether in the open market, by privately negotiated agreements or otherwise, subject to a number of factors, including general market conditions and other available investment and business opportunities. The disclosure respecting enCore's shareholdings contained in this news release is made pursuant to National Instrument 62-103 and a report respecting the above disposition will be filed with the applicable securities commissions and will be available for viewing at A copy of the report may also be obtained by contacting Robert Willette , Acting Chief Executive Officer, or at info@ About enCore Energy Corp. enCore Energy Corp., America's Clean Energy Company ™, is committed to providing clean, reliable, and affordable fuel for nuclear energy as the only United States uranium company with multiple central processing plants in operation. enCore operates the 100% owned and operated Rosita CPP in South Texas and the 70/30 joint venture Alta Mesa CPP with Boss Energy Ltd., with enCore operating as the project manager. The enCore team is led by industry experts with extensive knowledge and experience in all aspects of ISR uranium operations and the nuclear fuel cycle. enCore solely utilizes ISR for uranium extraction, a well-known and proven technology co-developed by the leaders at enCore Energy. Following upon enCore's demonstrated success in South Texas , future projects in enCore's planned project pipeline include the Dewey-Burdock project in South Dakota and the Gas Hills project in Wyoming . The Company holds other assets including non-core assets and proprietary databases. enCore is committed to working with local communities and indigenous governments to create positive impact from corporate developments. Neither TSX Venture Exchange nor its Regulation Services Provider (as that term is defined in policies of the TSX Venture Exchange) accepts responsibility for the adequacy or accuracy of this release.
