LTFRB’s PUV Contact Tracing: A Privacy Disaster in the Making?

Published June 28, 2021, 9:32 AM

by Robert D. Reyes

The Land Transportation Franchising and Regulatory Board (LTFRB) issued Memorandum Circular No. 2021-041 last 21 June 2021 requiring all PUV (public utility vehicle) operators and drivers to register with the StaySafePH contact tracing platform, create their QR Code, and have their QR Codes posted inside and at entrances of their vehicles. The said memo also requires all commuters to use the QR Codes to help combat the spread of the COVID-19 virus.

LTFRB x StaySafePH

An LTFRB representative confirmed that the directive includes both regular taxi cabs, GrabCar, and Angkas aside from the usual PUVs – jeepneys and buses.

The Memorandum Circular mandates all PUV operators to immediately shift to the use of StaySafePH from the previous manual filling-up of contact tracing form – something that is only implemented to PUVs originating at certain terminals. According to the LTFRB, all data obtained by the contact tracing app will be made available to them, subject to the Data Privacy Act of 2012. The government agency is also requiring all PUV operators and drivers to coordinate with StaySafePH for assistance in collecting and using the data obtained.

According to the LTFRB memo, failure to comply with the directive is tantamount to a violation of IATF health protocols, and the corresponding penalties – fines and possible revocation of CPC (Certificate of Public Compliance) or PA (Provisional Authority) – may be meted to erring PUV operators.

How About Commuters Without Any Smartphone?

I raised a valid concern with the LTFRB: what if a commuter does not own a smartphone or has a smartphone but does not have an internet connection (I still have to double-check if PLDT/Smart still offers free access to the contact tracing app)?

The initial response I got from the LTFRB: “For the passengers na walang smartphone at mobile internet, pwedeng gumawa at magpa-print sila ng sariling QR code tapos i-scan na lang ng sa terminals or ng driver/conductor.” (For passengers who do not have a smartphone and mobile internet, they can create and print their own QR code and then scan it at the terminals or by the driver/conductor.)

However, for one to be able to sign-up with StaySafePH, you need to have at least a mobile number (it seems that this is the unique identifier that the app is using). What if the commuter does not have a mobile number, then?

“If magkaroon po ng ganung special case, kailangan pa rin na may option for manual contact tracing po ang PUV,” (If you have such a special case, the PUV still needs to have an option for manual contact tracing) according to LTFRB Public Relations – so much for going digital if there will still be a manual option.

LTFRB Memorandum Circular No. 2021-041 will be fully implemented within 30 days after publication. Let’s see how the LTFRB will ensure that this memo is followed religiously by all PUV operators, drivers, and passengers. I went out to buy something last week, and I observed that most bus and jeepney passengers are no longer wearing face shields – something that has been made mandatory since last year.

Privacy Concerns on StaySafePH

Private software engineering solutions firm Multisys Technologies Corporation developed the StaySafePH app and was adopted by the Philippine government as its official contact tracing platform even without the complete vetting by the Department of Information and Communications Technology (DICT) and the National Privacy Commission (NPC). Multisys recently said that they had donated the platform to the Department of Interior and Local Government (DILG), following a statement from no less than the country’s Contact Tracing Czar, Baguio City Mayor Benjamin Magalong that StaySafePH has been rejected by the Department of Health (DOH). The software firm also claims that the app is open source, despite their failure to identify which open source licenses were used and where the general public can see the actual source code of StaySafePH.

Former DICT Undersecretary Eliseo Rio, Jr. and several local Information Technology (IT) experts had been vocal in airing their concerns and worry on the matter by which StaySafePH was selected as the official contact tracing app, and the software’s data privacy features (or lack of it) to a point of calling it as a “borderline spyware” a year ago.