Chaayos’ face recognition system gets caught in the privacy storm, company responds

Chaayos wants to take your photo to make your check in faster. But is it safe to use?

Chaayos’ face login service lands in controversy (Karun Sharma/Hindustan Times)

Popular tea store chain Chaayos is drawing flak over its facial recognition system set up at its outlets. The system, which is said to be aimed at replacing the OTP process, involves customers checking in using facial recognition.

According to a MediaNama report, the facial recognition interface doesn't provide terms and conditions before using customers' face data as well as there is no option to "opt-out" either. Some have expressed concerns over the use of the technology and how it could be misused.

Chaayos has now elaborated its terms on facial recognition on its website.

"You understand that the face authentication module on the permitted mobile device is provided by the third party, and we make no representation or warranty as to security of the face authentication function of any permitted mobile device and whether it works in the way that the third-party of device represents. If there is any loss arising from recognition, comparison, and verification problems for a certain type of mobile device, you need to negotiate with the manufacturer of the mobile device, and it has nothing to do with the bank."

Another terms on face recognition read: "Unless a law prohibits us from excluding or limiting our liability, we are not liable for any loss you incur in connection with the use or attempted use of the Chaayos Face Login service, or your instructions, or any unauthorised transactions through or in connection with the Chaayos Face Login service." 

. @Chaayos doing facial recognition instead of OTP. I took this video today.https://t.co/ecgOf56F2P

Issues:
1. No terms&conditions displayed
2. Consent isn't real when there's no opt out option
3. We don't know if chaayos will sell this data/gives itself the right to

More 👇

— Nikhil Pahwa , https://mstdn.social/@nixxin (@nixxin) November 20, 2019

 

Love your chai @Chaayos, but bring back the phone number authentication.

Facial recognition is eerie & disturbing & should be opt-in.

The cashier at SDA refused to let me use my existing @Chaayos wallet balance unless I register my face. #chaiSurvelliance #dystopian

— Ankit (@ankitmalik) November 16, 2019

 

The fact that Chaayos is making use of FRT without a proper notice and devoid of an opt-out goes against basic data protection principles. We urge govts. And companies to not use facial recognition technology, more so when India is still deliberating on a data protection law.

— sflc.in (@SFLCin) November 21, 2019

In response to our query Chaayos said, "We have recently launched a facial recognition feature at our Point of Sale as an option to eliminate the hassles of OTPs and reduce the overall customer purchase time. The feature is currently in the beta phase at select cafes and will be officially rolled out post thorough testing."

Contradictory to what the terms of facial recognition reads, Chaayos asserted that any user data collected is encrypted.

"Data from the facial recognition feature is encrypted and cannot be accessed by any party, including Chaayos itself except for the purpose of logging-in our customers. There is no third party sharing of the data for any purpose. And Chaayos does not use or process this information for any other purpose. We also provide our customers with a permanent "Opt-out" feature on our website, where-in they can choose to permanently delete their pictures captured by our systems at any point of time," the company said.

Chaayos also clarified that users have the option to opt-out of the facial recognition system and use their phone number instead. However some users on Twitter pointed out that there was no option to do so.

The latest privacy debate comes amid growing concerns over the usage of facial recognition technology among many other privacy concerns. Earlier this year, Google was reported to be paying $5 to people collect their face data. The company, however, last year announced that it did not intend to sell facial recognition technology.

"Like many technologies with multiple uses, facial recognition merits careful consideration to ensure its use is aligned with our principles and values, and avoids abuse and harmful outcomes," Kent Walker, Senior Vice President of Global Affairs at Google, said in a blog post last year.

The likes of Microsoft and IBM have also called for regulating the facial recognition technology. IBM earlier this month stressed that the authorities need to regulate the technology instead of imposing a ban. In a white paper posted on its website, IBM urged policymakers should understand that "not all technology lumped under the umbrella of 'facial recognition' is the same."

Story updated with Chaayos' statement.