No More Selfies and Audio-Video Recording, For Now: National Privacy Commission Suspends Grab's Data Processing Systems
The National Privacy Commission (NPC) is halting three of Grab’s personal data processing systems for alleged failure to comply with provisions in the Data Privacy Act of 2012 and possibly endangering the privacy rights of the riding public.
In a cease and desist order (CDO) issued on Wednesday, February 5, the NPC said it found deficiencies in Grab’s selfie verification, as well as pilot testing of its in-vehicle audio and video recording.
According to the NPC, Grab “did not sufficiently identify and assess the risks posed by the data processing systems to the rights and freedoms of data subjects.
“Only the risks faced by the company were taken into account,” in its Privacy Impact Assessment (PIA), the NPC said.
“The video recording system will also enable Grab employees to monitor the situation live from the Grab office and take photos of what is happening inside the vehicle, once the driver prompts the office through an emergency button,” the NPC notice further said.
According to the NPC, Grab will release photo, audio and video files collected through the three systems to police authorities in the event of dispute, conflict of complaint, although this was not explicitly communicated to the public in the company’s privacy notice and policy.
The NPC cited other reasons for its decision to issue the CDO, including the Grab’s alleged failure to mention the legal basis for processing the collected data, insufficient data submitted to establish whether the company’s data processing was proportional to its intended purpose, whether the benefits of the processing outweigh the risks involved, and whether the processing was the best solution to achieve its underlying purpose.
Reacting to the CDO, Grab said it has temporarily suspended the passenger selfie feature as well as the audio and video recording program and will work with the NPC to address the agency’s concerns.
Grab insists that all three programs were introduced as pioneering safety technology features to further protect the ride-hailing community and that all three features follow the legal criteria for lawful processing of data.
“We will fully cooperate with NPC in providing necessary supporting documents to adhere to their standards, implemet additional corrective measures, and ensure that NPC’s expectations and our approach for safety are mutually understood,” a Grab spokesperson said in a statement.
The Grab spokesperson added that the passenger selfie verification, and the audio and video recording feature are all being pilot-tested in other countries in Southeast Asia.
The NPC has given Grab Philippines 15 days to comply with its remedial measures, adding that the lifting of the CDO will be decided by the Commission on a per-system basis.