By Bernie Cahiles-Magkilat
A total of 180 Grab cars have collected video recording and audio recording of riders, according to the National Privacy Commission (NPC).
Based on NPC data, there were 90 cars each the pilot tests for video and audio recording systems of Grab Philippines.
The video recording was good for 6 weeks while the audio recording (was for a 2-week pilot), which Grab said started on January 13 this year only.
NPC has not released data as to the number of Grab riders that were subjected to these Grab systems before the data privacy authority suspended their implementation.
In a text message, NPC Commissioner Raymund Liboro said there is no determination that the three systems that they suspended were illegal. “Stored data might have more benefits for riders compared to risks something we hoped we were able to assess early on but didn’t see in the submissions they made. Thus, the notice of deficiencies,” Liboro said.
The NPC issued a Cease and Desist Order (CDO) on February 3, 2020 to Grab Philippines, Inc. after finding deficiencies in complying with the Data Privacy Act of 2012 (DPA) for three personal data processing systems, which may endanger the privacy rights of the riding public.
In a Notice of Deficiencies issued to Grab PH dated January 31, 2020, the NPC found several deficiencies in its selfie verification, pilot test of the in-vehicle audio recording, and pilot test of the in-vehicle video recording.
In the notice, the NPC said Grab PH did not sufficiently identify and assess the risks posed by the data processing systems to the rights and freedoms of data subjects, saying that “only the risks faced by the company were taken into account” in its Privacy Impact Assessment (PIA).
“The video recording system will also enable grab employees to monitor the situation live from the Grab Office and take photos of what is happening inside the vehicle, once the driver prompts the office through an emergency button,” the notice stated.
On the selfie verification, a passenger’s booking cannot be processed unless he or she takes a selfie for verification purposes by Grab.
According to Grab, the passenger selfie verification is piloting region-wide in Southeast Asia. Audio and video recording are also being tested in select markets.
Grab also said it will fully cooperate with NPC in providing necessary supporting documents to adhere to their standards, implement additional corrective measures, and ensure that NPCs expectations and its approach for safety are mutually understood.
Grab explained that the passenger selfie, audio and video recording pilot systems were introduced as pioneering safety technology features with the aim of further protecting the ride-hailing community. “These features follow the legal criteria for lawful processing of data,” it said.
It also said that data captured are encrypted and stored only for 10 hours for video files and 7 days for audio files.
Grab PH has 15 days to comply with the remedial measures directed in the NPC’s Notice of Deficiencies.
The NPC also stressed that the lifting of the CDO will be decided by the Commission on a per-system basis. As such, the order is applied separately for each of the systems and takes effect until such time that the company fully implements proper controls to address the deficiencies identified in the notice.