New Delhi: Chaayos, the multi-city chain of tea cafes, is under fire on social media for employing facial recognition, allegedly without customer consent.
The chain’s use of the technology was reported by the media when it made its Bengaluru debut this month, but it became a subject of controversy after Twitter users posted about it in the context of privacy.
Going through @chaayos terms and condition. This line, among so many others, stood out. This could be a on a t-shirt. pic.twitter.com/T4myye2WwC
— Nikhil Pahwa , https://mstdn.social/@nixxin (@nixxin) November 21, 2019
Chaayos reportedly uses facial recognition technology — which allows devices to identify users by their faces instead of passwords — to speed up orders for regular customers. The technology has been integrated into the chain’s ‘loyaltea programme’ that earns customers points for every visit and lets them encash them for free tea.
“Why put numbers through, when we can identify you?” is the message that flashes on the tablet through which the technology is employed. Customers, users alleged on Twitter, have no option to either refuse or opt out.
The programme earlier employed a one-time password (OTP).
What appears to be fanning the row is Chaayos’ privacy policy, which states that “customers should not expect that the customers information should always remain private”.
Approached for comment, Chaayos said the technology was currently being tested at select cafes. It was “launched… as an option to eliminate the hassles of OTPs and reduce the overall customer purchase time”, the chain added.
“Data from the facial recognition feature is encrypted and cannot be accessed by any party, including Chaayos itself, except for the purpose of logging-in our customers. There is no third-party sharing of the data for any purpose,” the chain said. “Customers have the right to not opt in for facial recognition… We also provide our customers with a permanent ‘Opt-out’ feature.”
Also read: Is India ready for mass facial recognition system to combat crime?
Internet experts back concerns
The controversy erupted as journalist Kumar Sambhav Shrivastava flagged the use of facial technology at Chaayos in a post on 17 November and pointed out that customers were not being asked for their consent.
Hello @Chaayos. Your sale counters are collecting facial image data of customers. What for? What are your consent and disclosures policies for its use? Are you aware of the legalities?
— Kumar Sambhav (@Kum_Sambhav) November 17, 2019
Medianama founder Nikhil Pahwa subsequently posted a series of tweets where he explained the potential risk of companies deploying facial recognition in the absence of any legislation governing its use.
. @Chaayos doing facial recognition instead of OTP. I took this video today.https://t.co/ecgOf56F2P
Issues:
1. No terms&conditions displayed
2. Consent isn't real when there's no opt out option
3. We don't know if chaayos will sell this data/gives itself the right to
More ?
— Nikhil Pahwa (@nixxin) November 20, 2019
Pahwa said the startup was “normalising facial recognition”.
“When govt starts doing facial recognition using cctv’s [sic], people will say ‘you can give your facial data for discounts at chaayos, but you cant let the government do facial recognition for national security?’”, he added.
Yes. They're normalising collection of sensitive personal information.
When govt starts doing facial recognition using cctv's, people will say "you can give your facial data for discounts at chaayos, but you cant let the government do facial recognition for national security?"
— Nikhil Pahwa (@nixxin) November 21, 2019
Internet experts backed the concerns.
“Right to privacy is a fundamental right and data protection is a part of the same,” said Apar Gupta, the founder of Internet Freedom Foundation, a public charitable trust. “However, in the absence of a data protection law, companies store and use the data and get away with it. It is questionable and potentially illegal.”
According to the draft data protection bill, he added, it is necessary to specify if the flow and use of personal data is appropriate.
“Even if the user has given their consent to share the data, she/he has a right to know where the data is being used and shared,” Gupta added. “But there is no legislative framework in place yet to deal with it.”
The Software Freedom Law Centre (SFLC), an organisation working in the sphere of digital freedom, said Chaayos’ use of the technology “goes against basic data protection principles”.
The fact that Chaayos is making use of FRT without a proper notice and devoid of an opt-out goes against basic data protection principles. We urge govts. And companies to not use facial recognition technology, more so when India is still deliberating on a data protection law.
— sflc.in (@SFLCin) November 21, 2019
Also read: Is the Russian-made FaceApp safe? Just consider how much more Google & Facebook know
India is a copycat but it seldom copies good things like hygiene. When imports restiction were relaxed at first, playboy and penthouse showed huge demand by the Indians. Silly