Vending machines at the University of Waterloo violated privacy act