Chaayos’ face recognition system gets caught in the privacy storm, company responds

Popular tea store chain Chaayos is drawing flak over its facial recognition system set up at its outlets. The system, which is said to be aimed at replacing the OTP process, involves customers checking in using facial recognition.

According to a MediaNama report, the facial recognition interface doesn't provide terms and conditions before using customers' face data as well as there is no option to "opt-out" either. Some have expressed concerns over the use of the technology and how it could be misused.

Chaayos has now elaborated its terms on facial recognition on its website.

"You understand that the face authentication module on the permitted mobile device is provided by the third party, and we make no representation or warranty as to security of the face authentication function of any permitted mobile device and whether it works in the way that the third-party of device represents. If there is any loss arising from recognition, comparison, and verification problems for a certain type of mobile device, you need to negotiate with the manufacturer of the mobile device, and it has nothing to do with the bank."

Another terms on face recognition read: "Unless a law prohibits us from excluding or limiting our liability, we are not liable for any loss you incur in connection with the use or attempted use of the Chaayos Face Login service, or your instructions, or any unauthorised transactions through or in connection with the Chaayos Face Login service." 

In response to our query Chaayos said, "We have recently launched a facial recognition feature at our Point of Sale as an option to eliminate the hassles of OTPs and reduce the overall customer purchase time. The feature is currently in the beta phase at select cafes and will be officially rolled out post thorough testing."

Contradictory to what the terms of facial recognition reads, Chaayos asserted that any user data collected is encrypted.

"Data from the facial recognition feature is encrypted and cannot be accessed by any party, including Chaayos itself except for the purpose of logging-in our customers. There is no third party sharing of the data for any purpose. And Chaayos does not use or process this information for any other purpose. We also provide our customers with a permanent "Opt-out" feature on our website, where-in they can choose to permanently delete their pictures captured by our systems at any point of time," the company said.

Chaayos also clarified that users have the option to opt-out of the facial recognition system and use their phone number instead. However some users on Twitter pointed out that there was no option to do so.

The latest privacy debate comes amid growing concerns over the usage of facial recognition technology among many other privacy concerns. Earlier this year, Google was reported to be paying $5 to people collect their face data. The company, however, last year announced that it did not intend to sell facial recognition technology.

"Like many technologies with multiple uses, facial recognition merits careful consideration to ensure its use is aligned with our principles and values, and avoids abuse and harmful outcomes," Kent Walker, Senior Vice President of Global Affairs at Google, said in a blog post last year.

The likes of Microsoft and IBM have also called for regulating the facial recognition technology. IBM earlier this month stressed that the authorities need to regulate the technology instead of imposing a ban. In a white paper posted on its website, IBM urged policymakers should understand that "not all technology lumped under the umbrella of 'facial recognition' is the same."

Story updated with Chaayos' statement.