In August 2025, Ontario’s Information and Privacy Commissioner issued a revised finding against the University of Waterloo for a privacy breach involving “smart” vending machines that secretly used biometric face detection technology. Students discovered the issue when an error message revealed the machines were running FacialRecognition.App.exe.

In this video, privacy lawyer David Fraser explains the Commissioner’s decision, why the University of Waterloo was found responsible under Ontario’s privacy law, and the lessons learned.

The IPC finding can be found here: https://decisions.ipc.on.ca/ipc-cipvp/privacy/en/item/521985/index.do

Where you can find me

► Privacylawyer blog: https://blog.privacylawyer.ca

► My law firm: https://www.mcinnescooper.com/people/...

► Twitter: https://twitter.com/privacylawyer

► LinkedIn: https://www.linkedin.com/in/davidtsfr...

Disclaimer: This is intended for education and information only and should not be taken as legal advice. If you need advice for your particular situation, you should seek out qualified counsel.

All views expressed are solely those of the creator and should not be attributed to his firm or any of its clients.