Ridesharing company Grab Philippines said it will comply with the National Privacy Commission’s (NPC) cease and desist order (CDO) against its new data-sensitive safety measures, adding that its new measures “follow the legal criteria for lawful processing of data.”
In a media statement, Grab said it will fully cooperate with the NPC after the privacy body found “deficiencies” in the company’s passenger selfie verification feature and the recent pilot test of in-vehicle audio and video recording.
“We will fully cooperate with NPC in providing necessary supporting documents to adhere to their standards, implement additional corrective measures, and ensure that NPC’s expectations and our approach for safety are mutually understood,” the statement read.
The passenger selfie verification, it said, was also being rolled out in other countries, especially in the Southeast Asian market, while audio and video recording were also being tested in select locations.
Grab also said its new safety features, meant “solely for purposes of maintaining the safety and security of platform users, and to assist law enforcement on investigations,” follow existing rules on lawful processing of data.
However, the NPC, in its recent statement, said Grab has failed to sufficiently identify and assess the risks posed by its new safety measures to the rights and freedoms of its passengers.
“Only the risks faced by the company were taken into account,” the NPC said in its privacy impact assessment of Grab’s new measures.
Among other issues mentioned by the NPC were Grab’s failure to inform its passengers that the photo, audio, and video files collected by the new systems would be released to police authorities upon request in the event of a dispute, conflict, or complaint, and failing to mention its legal basis in processing collected data.
It added that while there was an option for Grab passengers to withdraw consent for in-vehicle audio and video recording, the details on how to do so were “not sufficiently communicated to passengers.”
“It was also unclear if and how the data processing will be affected upon such withdrawal of consent,” the NPC said.
In the first half of January, Grab began a pilot run of in-vehicle audio and video recording in 180 of its GrabCar vehicles as a safety measure for both its drivers and passengers.
Grab’s passenger verification through selfie, meanwhile, was made mandatory by the company in the previous year for “identity verification, safety, and may be used to assist the authorities when required,” according to Grab’s website. (PNA)
