Chaayos, a popular retail chain that serves a range of food and beverages, has augmented its one-time-password (OTP) method by deploying a facial recognition feature to fulfil orders from customers. The move eliminates the need for returning customers of the chain to enter OTPs for each order. While the new deployment by the company, owned by the Delhi-based Sunshine Teahouse, is not a first in the sector, it has raised privacy concerns on social media. The company doesn’t first explicitly seek the consent of customers before capturing their facial data. The terms and conditions page on the Chaayos website also suggests that the company could share the facial data — alongside the phone number and other details of its customers — with third parties. Similar to Chaayos, Bengaluru-located tea retail chain Chai Point also has a facial recognition system within its order taking process. Gadgets 360 reached out to Chaayos for clarity on the issue.
For quite a long time, Chaayos requirrf customers to place an order at its kiosks by first registering their name and phone number on a tablet at the sales counter, and then entering the OTP they received on their mobile number. The company, however, has now upgraded that system with facial recognition for identifying returning customers. The new feature works through the tablets that have a decent front-facing camera to capture your facial features. If you’re a first time user, these tablets take your selfie when you enter your name, mobile number, and OTP to proceed with your order. The next time you visit the chain however, and place an order, the system is claimed by the company to identify you, eliminating the need for you to enter your name, mobile number, and OTP.
Instead of asking any explicit permissions from customers, the facial recognition feature shows a screen that has a Start button and text “Face it. Why put numbers through, when we can identify you?” — all in bold. This is where Chaayos starts the action and captures your facial data.
Gadgets 360 visited one of the Chaayos outlets in New Delhi and found that the process of taking portrait shots takes just a few seconds. Also, it works in the background — without letting customers know that they’re about to give their facial data to the outlet.
As per the terms and conditions specified on the Chaayos website, the “primary purpose” of collecting personal information and facial recognition feature is to allow customers to “access and use” the website and “visit” the outlets “to avail and purchase of” its services/ products. It also helps to “personalise your experience.” There is, however, no guarantee the customer data would always remain private to the company, as pointed out by Nikhil Pahwa of MediaNama.
“[A]lthough Sunshine Teahouse is committed to protecting customer’s privacy, Sunshine Teahouse does not promise or guarantee the same and customer should not expect, that customer’s personal information should always remain private,” the company said while defining its terms and conditions.
Chaayos doesn’t clearly mention that customers must provide their facial data to process orders. Nonetheless, one of the terms and conditions said that they need to use the facial recognition feature at the outlets to receive products and services from the company.
“While you can browse some sections of our website without being a registered member or visit the store/ outlet of the company, certain activities (such as placing an order) do require registration and require you to provide facial recognition feature and other the relevant information to the company,” the company stated.
As for the matter of user consent of using facial recognition, the terms and conditions blithely say, “Your use of the website and voluntarily providing above-mentioned Personal information through facial recognition feature at the outlet/ store of the company constitutes your CONSENT to all the terms and conditions contained in this privacy policy (as amended from time to time) and you shall be bound by the same.”
The exact launch date of the facial recognition feature by Chaayos is unclear. Nevertheless, a representative at the Chaayos outlet in Nehru Place told Gadgets 360 that it was rolled out less than a week ago. A report by Inc42 mentions the deployment of facial recognition by the company while detailing its debut in Bengaluru earlier this month.
Chaayos has been facing public outrage for taking facial data of its customers without notifying them properly. Several customers have posted their views on social media.
Hello @Chaayos. Your sale counters are collecting facial image data of customers. What for? What are your consent and disclosures policies for its use? Are you aware of the legalities?
— Kumar Sambhav Shrivastava (@Kum_Sambhav) November 17, 2019
☕️ Too much personal data for a cup of tea? ????
“Customer shouldn’t expect that their personal data should always remain private” reads T&C of @Chaayos which uses facial recognition instead of OTP. https://t.co/LpIXru5hU1— Subhashish P. ସୁଭ (@subhapa) November 21, 2019
The fact that Chaayos is making use of FRT without a proper notice and devoid of an opt-out goes against basic data protection principles. We urge govts. And companies to not use facial recognition technology, more so when India is still deliberating on a data protection law.
— sflc.in (@SFLCin) November 21, 2019
@Chaayos why is it mandatory to give your photo to order at chayos now, are you authorised to store clients facial data without their consent. Don’t you think its against right to privacy
— Pramod (@pramodjuyal13) November 13, 2019
MediaNama’s Pahwa says that it is “very worrying trend” that seems to be normalising facial recognition.
“Biometric information is sensitive personal data: once compromised, it is compromised forever,” Pahwa tells Gadgets 360. “I would strongly urge all private entities to voluntarily adopt a moratorium on using facial recognition systems until we have a law that protects privacy, and norms that restricts or prevents the usage of facial recognition systems.”
Prasanna S, a digital rights activist and one of the leading lawyers behind the right to privacy case, affirms that the Chaayos move is an “egregious violation of privacy” for collecting sensitive personal data without the data subject’s consent.
“Even under our IT Rules, biometrics including facial data is classified as sensitive personal data,” he underlines.
An email sent to Chaayos CTO Mohit Malik didn’t elicit any response at the time of publishing this story.
It looks like Chaayos isn’t alone in the race of bringing facial recognition into its order process. Chai Point has a similar system in place at least since December last year, as highlighted in a report by The Week.
In addition to private companies showing their interest towards building facial recognition systems to obtain biometric data, the National Crime Records Bureau (NCRB), under Home Ministry, is set to take such developments to a new level. It is aiming to establish the world’s largest facial recognition system to track and nab criminals. Some airports in the country have also started placing machines to recognise faces of passengers.