The National Privacy Commission asked Grab Philippines to suspend selfie verification, in-car audio and video recording pilot test in Metro Manila after finding deficiencies with the data privacy law.
It issued a notice of deficiencies to Grab Philippines dated Jan. 30, 2020, saying it found several deficiencies in selfie verification, pilot test of the in-vehicle audio recording and pilot test of the in-vehicle video recording that could endanger the privacy rights of the riding public.
NPC said Grab Philippines did not sufficiently identify and assess the risks posed by the data processing systems to the rights and freedoms of data subjects, saying “only the risks faced by the company were taken into account” in its privacy impact assessment.
“The video recording system will also enable Grab employees to monitor the situation live from the Grab office and take photos of what is happening inside the vehicle, once the driver prompts the office through an emergency button,” the notice read.
Company representatives said the photo, audio and video files collected through the three systems would be released upon request to police authorities in the event of dispute, conflict or complaint.
The public, however, was not told any of this information through Grab Philippines’ privacy notice and privacy policy.
Grab Philippines’ in-car audio and video recording pilot study in Metro Manila started in January as part of new security measures to protect both riders and drivers.
The pilot study will run for two to six weeks with more than 180 GrabCar vehicles, of which half will be equipped with in-car cameras and the rest with audio-recording capabilities.
NPC also said that Grab Philippines failed to mention its legal basis in processing the collected data.
“The documents submitted to the NPC were also found to be insufficient to establish whether the company’s data processing was proportional to its intended purpose; whether the benefits of the processing outweigh the risks involved; nor whether the processing was the best among considered alternatives to achieve the underlying purpose,” NPC said.
“While the option to withdraw consent was included by Grab Philippines in the PIA for the in-vehicle audio and in-vehicle video recording systems, the details on how to exercise such right were not sufficiently communicated to passengers through Grab message. It was also unclear if and how the data processing will be affected upon such withdrawal of consent,” it said.