I am not even using a Chinatrust card!
I have tested it. And it will no longer proceed if you don’t scan your face. This is a violation of our data privacy in my opinion as it is non consentual collection of data.
I agree, but is there any specific law on the Taiwan books to prevent this?
Is your lawyer on the case?
Yes, the PDPA. Still studying it.
Not yet. I try to do as much research as possible and only use as a last resort. I am currently figuring out what relevant agencies can help and hopefully process a formal complaint.
What I see so far is:
Article 3 - Your Rights
A data subject shall be able to exercise the following rights with regard to his/her personal data and such rights shall not be waived or limited contractually in advance:
1.the right to make an inquiry of and to review his/her personal data;
2.the right to request a copy of his/her personal data;
3.the right to supplement or correct his/her personal data;
4.the right to demand the cessation of the collection, processing or use of his/her personal data; and
5.the right to erase his/her personal data.
Article 5
The collection, processing and use of personal data shall be carried out in a way that respects the data subject’s rights and interest, in an honest and good-faith manner, shall not exceed the necessary scope of specific purposes, and shall have legitimate and reasonable connections with the purposes of collection.
Article 7
“Consent”, as referred to in subparagraph 2, paragraph 1 of Article 15 and subparagraph 5, paragraph 1 of Article 19, means a declaration of agreement given by a data subject after he/she has been informed by the data collector of the information required under the PDPA.
“Consent”, as referred to in subparagraph 7, paragraph 1 of Article 16 and subparagraph 6, paragraph 1 of Article 20, means a separate declaration of agreement given by a data subject after he/she has been informed by the data collector of any of the purposes other than that originally specified, the scope of other use, and the impact of giving or not giving consent on the rights and interests of the data subject.
The data subject’s consent may be presumed given pursuant to subparagraph 2, paragraph 1 of Article 15 and subparagraph 5, paragraph 1 of Article 19 if the data subject does not indicate his/her objection and affirmatively provides his/her personal data after the government or non-government agency has informed the data subject of the relevant information specified in paragraph 1 of Article 8 of the PDPA.
The data collector shall bear the burden of proof regarding the fact that the data subject has given the consent prescribed under the PDPA.
Article 8
Government or non-government agencies shall expressly inform the data subject of the following information when colleting their personal data in accordance with Article 15 or 19 of the PDPA:
1.the name of the government or non-government agency;
2.the purpose of the collection;
3.the categories of the personal data to be collected;
4.the time period, territory, recipients, and methods of which the personal data is used;
5.the data subject’s rights under Article 3 and the methods for exercising such rights; and
6.the data subject’s rights and interests that will be affected if he/she elects not to provide his/her personal data.
The obligation to inform as prescribed in the preceding paragraph may be waived under any of the following circumstances:
1.where notification may be waived in accordance with the law;
2.where the collection of personal data is necessary for the government agencies to perform their statutory duties or the non-government agencies to fulfill their statutory obligation;
3.where giving notice will prevent the government agencies from performing their statutory duties;
4.where giving notice will harm public interests;
5.where the data subject has already known the content of the notification; or
6.where the collection of personal data is for non-profit purposes and clearly has no adverse effect on the data subject.
Article 9
Government or non-government agencies shall, before processing or using the personal data collected in accordance with Article 15 or 19 which was not provided by the data subject, inform the data subject of their source of data and other information specified in subparagraphs 1 through 5, paragraph 1 of the preceding article.
The obligation to inform as prescribed in the preceding paragraph may be exempt under any of the following circumstances:
1.under any of the circumstances provided in paragraph 2 of the preceding article;
2.where the personal data has been manifestly made public by the data subject or publicized legally;
3.where it is unable to inform the data subject or his/her legal representative;
4.where it is necessary for statistics gathering or academic research in pursuit of public interests, provided that such data, as processed by the data provider or as disclosed by the data collector, may not lead to the identification of a specific data subject; or
5.where the personal data is collected by mass communication enterprises for the purpose of news reporting for the benefit of public interests.
The obligation to inform as prescribed in paragraph 1 may be performed at the time of the first use of the personal data towards the data subject.
Article 19 - Consent
Except for the personal data specified under paragraph 1 of Article 6, the collection or processing of personal data by non-government agencies shall be for specific purposes and on one of the following bases:
1.where it is expressly required by law;
2.where there is a contractual or quasi-contractual relationship between the non-government agency and the data subject, and proper security measures have been adopted to ensure the security of the personal data;
3.where the personal data has been manifestly made public by the data subject or publicized legally;
4.where it is necessary for statistics gathering or academic research by an academic institution in pursuit of public interests, provided that such data, as processed by the data provider or as disclosed by the data collector, may not lead to the identification of a specific data subject;
5. where consent has been given by the data subject;
6.where it is necessary for furthering public interests;
7.where the personal data is obtained from publicly available sources unless the data subject has an overriding interest in prohibiting the processing or use of such personal data; or
8.where the rights and interests of the data subject will not be infringed upon.
A data collector or processor shall, on its own initiative or upon the request of the data subject, erase or cease processing or using the personal data when it becomes aware of, or upon being notified by the data subject, that the processing or use of the personal data should be prohibited pursuant to the proviso to subparagraph 7 of the preceding paragraph.
So if you go up with a mask and hat they wont give you any cash?
Yea. First I stepped away and then I tried pulling my shirt over my face.
The guy behind me was pissed.
Machine refused to continue.
I guess if you don’t consent you use another atm or if with China trust complete banking inside bank.
I can see why they might want to do this, to stop money laundering, where syndicates have control of multiple bank accounts under other people’s names.
The issue is, it doesn’t allow me to consent or withdraw.
It just automatically scans your face and by the time you realise, it’s done and you have no control.
I have a right to consent.
That seems to suggest they have some way of verifying the faces of people from other banks. I know bank accounts are linked to people’s ID numbers, but I’m slightly surprised that photos are on there too.
Also, what about international cards where they don’t have people’s photos? Not that CTBC ATMs are a good choice for those because of the fee, but still.
Is it possible that it’s simply recording what is happening with a camera, determining that you’re wearing a mask, and not allowing that? As opposed to doing some kind of individual facial recognition?
That might make sense? And I guess ATMs in a lot of countries have been covered by CCTV cameras for ages.
I doubt it can be facial recognition because I have a chinatrust card and they never took a photo of me to use for comparison. My ARC photo from when I opened the account is 15 years out of date so not that helpful.
I wonder if this is ‘just’ recording who is using the ATM, perhaps also looking for cases where someone is being coerced into using an ATM (via AI looking for signs) or even for use if a card is stolen to get an image of the thief, and the refusal to work if using a mask makes sense from that point of view if they want to make sure to have a good image of who is using the machine to make a particular withdrawal. If that is the case then I don’t mind at all.
It could record your image and facial recognition data on first use of the new atm… then use that as baseline for future transactions. Whilst also cross-referencing against other accounts to stop fraud money laundering.
But i’ve used this ATM before. Multiple times.
If it is simply recording who is using the ATM, it is using at least some form of machine-learning to determine if the image is meeting requirements.
And it is not clearly telling you what is being done with the data.
https://www.taiwannews.com.tw/news/6086725
Was being trialled last year. Seems all above board.
Saw something the other day about someone in Europe travelling with their idential twin daughers and using the facial recog at the airport to checkin etc etc, the system assigned the wrong twin to the first one and then when they tried to check in the 2nd one the system said they couldn’t because they were already checked in.
I guess more wotk needed there.
Well. If anyone wants to join in opposing this, then feel free to do so.
Just to bring this backt to life:
“TAIPEI (Taiwan News) — The Ministry of Finance is requiring eight state-owned banks to install anti-fraud ATMs incorporating AI facial recognition to strengthen efforts to combat fraud, per Liberty Times.”
https://www.taiwannews.com.tw/news/6321163
Looks like this will become the norm soon and not the abnormal.
Key word here.
I think you’re missing the point, it’s state-owned banks now, but it’ll spread pretty soon and cover all banks.