this post was submitted on 24 Feb 2024
372 points (98.4% liked)

Technology

59675 readers
3701 users here now

This is a most excellent place for technology news and articles.

Our Rules

  1. Follow the lemmy.world rules.
  2. Only tech related content.
  3. Be excellent to each another!
  4. Mod approved content bots can post up to 10 articles per day.
  5. Threads asking for personal tech support may be deleted.
  6. Politics threads may be removed.
  7. No memes allowed as posts, OK to post as comments.
  8. Only approved bots from the list below, to ask if your bot can be added please contact us.
  9. Check for duplicates before posting, duplicates may be removed

Approved Bots

founded 1 year ago
MODERATORS
[email protected]
[email protected]
[email protected]
[email protected]
[email protected]
372
University vending machine error reveals use of secret facial recognition | A malfunctioning vending machine at a Canadian university has inadvertently revealed that a number of them have been usin... (www.theguardian.com)
submitted 9 months ago by [email protected] to c/[email protected]
72 comments fedilink hide all child comments
 

University vending machine error reveals use of secret facial recognition | A malfunctioning vending machine at a Canadian university has inadvertently revealed that a number of them have been usin...::Snack dispenser at University of Waterloo shows facial recognition message on screen despite no prior indication

you are viewing a single comment's thread
view the rest of the comments
[–] nicerdicer2 11 points 9 months ago* (last edited 9 months ago) (2 children)

Bad news, the manufacturer is located in Switzerland and, as stated in the brochure, they advertise their product as "Made in EU". Probably to implicate that any data which will be collected and processed will be under the terms of GDPR.

I haven't looked up the terms regarding GDPR, but I assume that their data collection is somewhat "compliant" with GDPR, which does not necessaryly mean anything. It can just mean that data is not stored locally, albeit it will be send to the manufacturer (but probably entcrypted). However, under GDPR you can enforce your right of deletion of the collected data - that is, if you know that data about you has been collected.

What makes this issue so severe is that it would have never been detected that data has been collected and processed, if it weren't for a malfunction.

Edit: grammar, spelling

[–] [email protected] 10 points 9 months ago (1 children)

Switzerland is not in the EU. Also even if it was, it's not illegal to design/manufacture solutions that don't comply with GDPR. They just can't be sold in the EU.

Also, data collection absolutely requires consent, it's why cookie popups exist on every website.

[–] nicerdicer2 5 points 9 months ago

That is correct. Switzerland is not a part of the European Union. The manufacturer, Invenda, is located in Switzerland. That is where their headquarters are. It might be possible that their vending machines are produced within the EU (another country where production costs are lower). It might be possible that these specific models (those who offer data collection) are designed for markets outside of EU.

They advertise their product as "Made in EU" (see brochure). This could be made on purpose to implicate that their data collection meets GDPR requirements, leading to believe that everything is compliant with the law.

[–] [email protected] 2 points 9 months ago (1 children)

Under GDPR you also need explicit consent for data collection, right?

[–] nicerdicer2 1 points 9 months ago

Correct. The said vending machine was collecting data without users consent. And because it was facial recognition data it means that the collected data can be tied to an individual.

It would have been different if the collected data was just a counter which indcated the number of users of that machine. These kind of data could not have been tied to a specific individual.