Grab in-car recording suspended on privacy concerns
GRAB Philippines has suspended its pilot selfie verification and in-vehicle video and photo recording processes after the National Privacy Commission (NPC) raised objections over passenger privacy protections.
NPC said in a statement Wednesday said it issued a cease and desist order to Grab for deficiencies in complying with the Data Privacy Act of 2012, after sending the company a notice of deficiencies on Jan. 31.
“Grab PH did not sufficiently identify and assess the risks posed by the data processing systems to the rights and freedoms of data subjects, saying that ‘only the risks faced by the company were taken into account’ in its Privacy Impact Assessment (PIA),” NPC said.
Grab representatives said that photo, video, and audio files are collected on its system for release to the police in case of a dispute, conflict, or compliant. Selfie verification to confirm passenger identity is being piloted across Southeast Asia.
The NPC said the public was not informed of the systems in Grab’s privacy notice and policy.
The commission said that Grab has not communicated to passengers that they can withdraw consent from being recorded.
NPC said that Grab did not inform the commission of the legal basis for collecting data. The commission said that documents submitted by Grab do not show whether the data processing is fit for purpose, whether alternatives were considered, and whether benefits outweigh risks.
“While this Commission believes that the security of passengers and drivers is a primordial concern, their privacy rights must not be disregarded. It must be protected with earnestness by ensuring that the purpose of data processing is clearly stated, the data flow is secured, and the risks are properly identified and mitigated,” NPC said in the CDO.
Grab said in a statement that the features were introduced as a safety measure to protect passengers following “legal criteria for lawful processing of data.”
The company however said it is complying with NPC and suspending data collection.
“We recognize the mandate of the National Privacy Commission (NPC) to protect user privacy. Passenger selfie feature and audio and video recording pilot have been temporarily suspended as we work with NPC to address their concerns.”
“We will fully cooperate with NPC in providing necessary supporting documents to adhere to their standards, implement additional corrective measures, and ensure that NPCs expectations and our approach for safety are mutually understood.”
NPC gave the company 15 days to comply with its remedial measures, stating that the order to cease and desist will apply on each data collection process until Grab fully implements proper controls to address the deficiencies identified by the commission. — Jenina P. Ibañez
