Ontario smart vending machines excessively collected personal data

Ontario's Privacy Commissioner found that smart vending machines at the University of Waterloo collected excessive personal data, exceeding what was needed to sell snacks. The machines violated privacy laws. The investigation revealed the machines used facial recognition, recording purchase and demographic data, and potentially detecting moods. The university failed to conduct proper due diligence before installing the machines, which were removed after student complaints. The commissioner emphasized the need for institutions to conduct privacy impact assessments and provide public notice of data collection practices. New regulations, effective July 1, will grant the commissioner more enforcement powers.