Grab PH stops selfie verification and in-car recording due to privacy concerns

Grab had introduced selfie verification last year to improve safety for both its driver-partners and passengers. In the Philippines, the ride-hailing company was recently issued a Cease and Desist Order by the National Privacy Commission after deficiencies in complying with the Data Privacy Act for 2012 (DPA) were found. According to the commission, this endangers the privacy rights of Grab passengers.

Grab PH was issued a notice on 31st January 2020 and the commission has identified shortcomings in its selfie verification, pilot test of the in-vehicle audio recording, and pilot test for in-vehicle video recording. The NPC said that Grab did not sufficiently identify and assess the risks posed by the data processing system to the rights and freedoms of its data subjects. They added that only the risks faced by the company were taken into account, according to its Privacy Impact Assessment (PIA).

According to the notice, Grab’s video recording system will allow their staff to monitor the situation live from the Grab office and take photos of what is happening in the vehicle if a Grab driver alerts them via an emergency button. The company said that photos, audio and video files that are collected by all three systems will be released to the police upon request in the event of a dispute, conflict or complaint. However, the NPC found that the public was not told any of this information through Grab’s privacy notice and privacy policy.

They added that Grab has failed to mention its legal basis in collecting the data and their documents submitted to the NPC was not sufficient to establish if the company’s data processing was proportional to its intended purposes. The commission noted that Grab PH provides the option to withdraw consent for the in-vehicle audio and in-vehicle video but details on how to do so were not communicated clearly to its passengers. It was also unclear if and how the data processing will be affected if a passenger withdraws consent.

Grab PH is given 15 days to comply with the remedial measures, and the lifting of the Cease and Desist Order will be decided on a per-system basis. They highlighted that the CDO is not a penalty but as a means to provide Grab the opportunity to fully comply with the Data Privacy Act.

According to TechinAsia, Grab had started its pilot study for in-car video and audio recording last month. It was set to run for 2 to 6 weeks with over 180 GrabCars in Metro Manila. It was reported that Grab will encrypt and store the data collected in their database for a week for audio recording and for 10 hours for videos.

Grab has temporarily suspended the three safety features and will work closely with the commission to address its privacy concerns. In December, Grab was fined PHP 16.1 million (around RM1.3 million) by the Philippines’ antitrust body for overpricing and cancellation of customer rides. It was reported that Grab Philippines will disburse PHP 14.1 million to affected passengers via GrabPay that took rides between 11th May to 10th August 2019. The remaining PHP 2 million will be paid directly to the Philippine Competition Commission (PCC).

[ SOURCE, VIA ]