Privacy body stops Grab’s test of video, audio recording of passengers

The country’s privacy watchdog agency had suspended a pilot test of Grab Philippines that kept video and recordings of its passengers, noting that the company gave more weight to its risks than its riders’.

The National Privacy Commission (NPC) had also suspended the selfie verification program of Grab for the same reason.

These three initiatives, the NPC said, “may endanger the privacy rights of the riding public.”

The issue marked another point of conflict with regulators, as Grab Philippines remains the biggest player in the local ride hailing market after buying out Uber, its main competitor, in 2018.

The Uber buyout triggered competition concerns that were not always addressed.

In this case, personal data collected by Grab was supposed to help authorities piece together information in cases of conflict which would allow Grab to give police the entire picture if requested.

The video recording system, for example, will give Grab employees in the Grab Office a front row seat to what is happening inside a vehicle in cases of the driver pushing the emergency button.

The NPC said despite good intentions, the efforts failed to strike a balance between security and privacy.

The commission added that Grab had not given much thought to the risks passengers are being exposed to and “only the risks faced by the company were taken into account.”

The NPC said while it “believes that the security of passengers and drivers is a primordial concern, their privacy rights must not be disregarded.”

The commission sent a cease and desist order to Grab last Tuesday (Feb. 4) a few days after the NPC flagged Grab’s deficiencies in a notice issued on Jan. 31.

The Jan. 31 notice came long after Grab had already started its pilot test of the new security features, which began on Jan. 13 for 180 Grab vehicles in Metro Manila.

The pilot test ran for two to six weeks with half of the number of cars being equipped with cameras while others equipped with audio recording equipment.

At the launch of the pilot test, Grab said the new measures were another “layer of security” for drivers and passengers.

Similar programs were launched in other countries, such as Grab in Jakarta and Uber in the United States.

Grab had said it was complying with the Data Privacy Act but the NPC said the company failed to cite a legal basis for collecting passenger data.

The NPC also said Grab was unable to establish if benefits outweighed risks and if the new security layer was the only way to achieve its objective.

Grab had tried to downplay privacy concerns by saying that riders always had the choice to opt out without penalty after being informed in advance of the recording equipment.

If the passenger consented, Grab said audio and video recordings would be encrypted and stored in Grab’s database for seven days for audio and 10 hours for video.

The NPC, however, said details about how passengers could opt out were “not sufficiently communicated.” The agency added it was not clear how data processing would be done if consent had been withdrawn.

The NPC gave the company 15 days from Jan. 31, or until the first half of February, to comply with proposed remedial measures. The measures were not specified.

The cease and desist order would remain in effect on a case-to-case basis for each of Grab’s data privacy programs until Grab had addressed the deficiencies cited by the NPC.

The NPC clarified that the order was not a penalty, but an opportunity for Grab to fully comply with the law.

The NPC stopped short of saying whether it would bar Grab from using the recording systems subject of the order.

“The move, in effect, secures the riding public from unwanted privacy exposure,” said the NPC.

It also gave Grab a chance to “modify its system to be complaint with the DPA,” the NPC added, referring to the Data Privacy Act.

Grab has not responded to requests for comment.

Edited by TSB