Privacy concerns over facial-recognition system at Indira Canteens

Bengaluru: The Bruhat Bengaluru Mahanagara Palike (BBMP) has announced plans to introduce facial recognition-enabled self-ordering at Indira Canteens. 

Under the initiative, customers' facial details will be captured by Android devices to create a centralised databased of daily footfall at the city's 174 physical and 24 mobile canteens. According to the BBMP, this will help hold contractors accountable. 

Eleven canteens were recently shut for nearly two weeks after the BBMP suspected contractors of inflating bills and withheld payment. 

To record the accurate number of meals sold, the BBMP initially devised a One Time Password (OTP) system but withdrew it due to concerns that it was time-consuming and many customers might not have mobile phones. 

The BBMP then proposed the facial-recognition system. After testing it at four eateries in the RR Nagar zone, the civic body plans to expand it citywide. Its IT department will soon float tenders to select the vendor. 

However, privacy rights activists argue that mandating such technology might make nutrition inaccessible to the urban poor, defeating the purpose of establishing Indira Canteens. There are also privacy concerns. 

Srinivas Kodali, an independent researcher of data and privacy, noted that such databases often end up promoting surveillance and policing of the working class. "Identity and access management causes exclusion, which has widely been seen with Aadhaar,” he said. 

Shweta Mohandas, a researcher with the Centre for Internet and Society, highlighted concerns about compliance with the Digital Personal Data Protection Act.

"The bare minimum requirement of the act is notice and consent,” she said, questioning whether not consenting to use facial recognition would result in denial of food. 

A 2023 survey by economist and IIT Delhi Professor Reetika Khera found marshals deployed at each canteen are "supposedly there to monitor the number of meals delivered by the contractor, meals sold and consumed, and whether adequate quantities are being served to guests." 

"The marshals did little more than hang around and watch videos on their phones. When the survey team was talking to guests or canteen workers, they got jittery," she said.

BBMP Special Commissioner (Health) Suralkar Vikas Kishor said a centralised database of meals sold was needed because contracts were given to private companies and promised that the data would not be shared with third parties. 

Logeesecure LLP (LOGSAFE), a Bengaluru-based startup that designed the facial-recognition system, claims the devices record footfall but do not store any biometric details. 

It said customers' data was monitored by "a vector-based method which creates an AI replica of the person-like data points." 

A company representative said, "The actual image or videos of the persons will not be stored anywhere. People should not be afraid of any privacy issues." 

He added that their application uses facial recognition technology developed by the National Institute of Standards and Technology (NIST).