A Philippine privacy agency has ordered Grab to cease its selfie verification as well as its audio and video recording systems, as the ride-hailing giant failed to comply with the country’s Data Privacy Act.
In a notice of deficiencies issued to Grab Philippines, dated January 31 this year, the National Privacy Commission of the Philippines (NPC) said it found inadequacies with the company’s data processing systems, leading to a cease and desist order.
To use its services, Grab required passengers to take a selfie as a security measure. It also rolled out the same feature in its other markets such as Malaysia and Singapore.
Just last month, Grab started a pilot study in the Philippines for its in-car video and audio recording system. The said program, which started January 13, was set to run for two to six weeks with over 180 GrabCar vehicles in Metro Manila.
Grab previously said that the data collected will be encrypted and stored securely in its database for a week for audio recordings and ten hours for videos.
According to the NPC, Grab Philippines did not sufficiently identify and assess the risks associated with the new systems to the rights of its users. The regulatory body said that “only the risks faced by the company were taken into account” in its privacy impact assessment.
The company also allegedly failed to mention its legal basis in processing the collected audio, video, and photographic data. The NPC found that the documents submitted by Grab failed to clearly establish if the data collection was being done for its intended purpose, if the system’s benefits outweigh its risks, and if it was the best option Grab had for its underlying goal.
Grab, however, emphasized that the features “follow the legal criteria for lawful processing of data.”
The company also said that it had temporarily suspended the features and plans to continue working with the NPC to address the agency’s concerns.
“We will fully cooperate with NPC in providing necessary supporting documents to adhere to their standards, implement additional corrective measures, and ensure that NPC’s expectations and our approach for safety are mutually understood,” it said in a statement.
The order comes just over a month after the Philippines’ antitrust body fined Grab with PHP 16.1 million (around USD 319,000) for overpricing and ride cancellations. According to the Philippine Competition Commission, the decision was based on an audit from an independent monitoring trustee tasked to monitor Grab’s compliance with its pricing and service commitments.
This article first appeared in Tech in Asia.