Order Text
IN RE: GRAB PHILIPPINES NPC CC 20-001
x----------------------------------------------------x
ORDER
Before the Commission is the Compliance/Manifestation of Grab Philippines (Grab PH) dated 03 March 2022 to the Resolution dated 03 February 2022.
On 03 February 2022, the Commission issued a Resolution requiring Grab PH to comply with the following:
WHEREFORE, premises considered, this Commission hereby NOTES the following: 1) Motion to Resolve (Re: Compliance and Motion to Lift Cease-And-Desist Order dated 3 February 2020), dated 19 January 2022; and 2) Compliance and Motion to Lift Cease-And-Desist Order dated 3 February 2020, dated 22 June 2021, submitted by Grab PH.
Grab PH is ORDERED to submit its Privacy Impact Assessment for its In-Vehicle Audio Recording project within fifteen (15) days from receipt of this Resolution.1
In compliance with the Resolution, Grab PH submitted its Privacy Impact Assessment (PIA) In-Vehicle Audio Recording dated 06 February 2020.2
On 03 March 2022, Grab PH submitted its Manifestation (Re: Resolution dated 03 February 2022) manifesting that “it has decided to indefinitely suspend the implementation of the In-Vehicle Audio Recording and In-Vehicle Video (CCTV) Recording projects.”3 Further, Grab PH manifested that “it has decided to implement only the Consumer Verification via Selfie project as soon as the Cease-and-Desist Order (CDO) in the same is lifted by [the] Honorable Commission.”4
The National Privacy Commission’s Compliance and Monitoring Division (CMD) issued its Technical Report dated 17 May 20225 (Technical Report) to the Compliance submitted by Grab PH.
In the Resolution dated 03 February 2022, the Commission ordered Grab PH to submit its Privacy Impact Assessment (PIA) In-Vehicle Audio Recording.6
Nevertheless, this Commission deems it appropriate that Grab PH must first remediate the issues found in its PIA in accordance with the DPA.
In Grab PH’s PIA on the Consumer Verification via Selfie dated 6 February 2020, it stated that:
Consumer Selfie data retention period are as follows:
…
- Retain the Consumer selfie for the Consumers who are related to safety incidents. The data of Consumers involved in safety incidents are retained as long as Grab or its affiliate/successor offers its services to the public. We need to retail the data because if the Consumer decides to come back and create another account in the future, if an account has been blocked that has a safety incident, the Consumer will not be able to create it based on the selfie.7
In the Technical Report of CMD, it was indicated that:
In this case, Grab PH may consider as the basis of its retention period the prescriptive periods in filing the appropriate action for the resolution of the safety incident in the proper court or forum. Likewise, Grab PH may also consider defining the various gravity of its safety incidents and accordingly adjust the retention period depending on the gravity.8
Section 11(e) of the DPA provides:
SEC. 11. General Data Privacy Principles. – The processing of personal information shall be allowed, subject to compliance with the requirements of this Act and other laws allowing disclosure of information to the public and adherence to the principles of transparency, legitimate purpose and proportionality.
Personal information must be:
…
(e) Retained only for as long as necessary for the fulfillment of the purposes for which the data was obtained or for the establishment, exercise or defense of legal claims, or for legitimate business purposes, or as provided by law;9
…
Here, Grab PH indicated in its PIA that the Consumer Selfie may be retained as long as necessary if it is related to safety incidents.10 However, the Commission considers that while these may be limited to individuals involved in safety incidents, the retention for an indefinite period is contrary to the DPA.
The Commission deems it appropriate that by revising the retention period stated in Grab PH’s PIA and aligning it to the DPA, it essentially acquaints the data subject on how the personal data is being retained consistent with its purpose to “reduce criminal incidents and improve safety to its riders.”11
As to the disposal of selfie data, Grab PH indicated in its PIA:
The disposal of selfie data stored in AWS S3 is done by the Grab Database Team, upon request and approval from the Grab Safety Engineering Team. Selfie data will be disposed if:
Requested by the Consumer (not available for users who have committed crime or have otherwise violated Code of Conduct and had their account access privileges revoked);
Selfie will be removed after the Consumer account becomes inactive i.e dormant, per Grab account archival policy, unless the account is related/involved in any safety incidents. Grab will delete the data of Consumers who are dormant after 180 days. The cleanup activity (of selfie data) is manually triggered by Grab Safety Engineers once in every six (6) months. The deletion process is triggered manually once in 6 months and safety teams are implementing to auto trigger the deletion process once in 6 months. (ETA to implement auto triggers is by the end of 2021). If consumers were involved in any safety incidents, their selfie will not be deleted.12
Rule IV, Section 19 D(3) of the Implementing Rules and Regulation of the Data Privacy Act of 2012 (IRR), provides that:
Section 19. General principles in collection, processing and retention. The processing of personal data shall adhere to the following general principles in the collection, processing, and retention of personal data:
d. Personal Data shall not be retained longer than necessary.
…
- Personal data shall be disposed or discarded in a secure manner that would prevent further processing, unauthorized access, or disclosure to any other party or the public, or prejudice the interests of the data subjects.13
In Grab PH’s PIA, it was not mentioned whether the selfie data would be stored permanently on AWS S3 servers.14 It is uncertain whether the safe disposal of selfie data on the records is manifested in some other document.15
To adhere to the general privacy principles, the Commission requires Grab PH to submit in detail the secure manner of disposal of the consumer selfie upon its deletion from the AWS S3 system. The data subject has the right to be informed on how the personal data is being disposed of to prevent unnecessary processing.16
It must be noted that the PIA for Consumer Verification via Selfie is dated 06 February 2020 and the revised PIA for Consumer Verification via Selfie already includes Grab PH’s compliance with the Commission’s findings and the project’s expansion to include users of Grab PH delivery services.17
Nonetheless, Grab PH must ensure that a regular conduct of the PIA is done to avoid security incidences and data breaches from occurring not only for this project but for its other systems, programs, measures, procedures, and technology products as well. Grab PH, the PIC, may require Amazon AWS, the PIP, to conduct a PIA to ensure that all possible risks were addressed.18
Based on the foregoing, the Commission deems it necessary that Grab PH must address the issues prior to the lifting of the Cease-and-Desist Order.
WHEREFORE, premises considered, the Commission hereby ORDERS Grab Philippines to:
-
REVISE the retention period involving consumer selfie of individuals involved in safety incidents and SUBMIT the revised PIA incorporating such;
-
SUBMIT the documents detailing the secure manner of disposal of the consumer selfie upon deletion from the AWS S3 system; and
-
INCLUDE AWS S3 in the next conduct of Privacy Impact Assessment to ensure that all possible risks are addressed. If AWS S3 conducts its own PIA, consider appending the same to Grab PH’s PIA.
Grab PH shall SUBMIT its compliance with the aforementioned directives of the Commission directly to the Compliance and Monitoring Division (CMD) within fifteen (15) days upon receipt of this Order.
SO ORDERED.
City of Pasay, Philippines. 19 January 2023.
JOHN HENRY D. NAGA Privacy Commissioner
LEANDRO ANGELO Y. AGUIRRE Deputy Privacy Commissioner
NERISSA N. DE JESUS Deputy Privacy Commissioner
Copy furnished:
DG Data Protection Officer
QT Counsel for Grab Philippines
COMPLIANCE AND MONITORING DIVISION ENFORCEMENT DIVISION GENERAL RECORDS UNIT
Footnotes
-
In re: Grab Philippines, NPC CC 20-001, Resolution dated 03 February 2022. ↩
-
Grab PH’s Privacy Impact Assessment Consumer Verification via Selfie dated 06 February 2020. ↩
-
Grab Philippines Manifestation (Re: Resolution dated 03 February 2022) dated 03 March 2022, at p. 1. ↩
-
Id. ↩
-
Compliance and Monitoring Division (CMD), Revised Technical Report on Grab Philippines’ Consumer Verification via Selfie Project dated 17 May 2022. ↩
-
In re: Grab Philippines, NPC CC 20-001, Resolution dated 03 February 2022. ↩
-
Grab PH’s Privacy Impact Assessment Consumer Verification via Selfie dated 06 February 2020, at pp. 15-16. ↩
-
Compliance and Monitoring Division (CMD), Revised Technical Report on Grab Philippines’ Consumer Verification via Selfie Project dated 17 May 2022, at p. 4. ↩
-
An Act Protecting Individual Personal Information in Information and Communications Systems in the Government and the Private Sector, Creating for This Purpose a National Privacy Commission, and for Other Purposes Data Privacy Act of 2012, Republic Act No. 10173, chapter III, §11(e) (2012). ↩
-
Grab PH’s Privacy Impact Assessment Consumer Verification via Selfie dated 06 February 2020, at pp. 15-16. ↩
-
Id., at p. 4. ↩
-
Id., at p. 18. ↩
-
National Privacy Commission, Implementing Rules and Regulations of the Data Privacy Act of 2012, rule IV, §19 D(3) (2016). ↩
-
Grab PH’s Privacy Impact Assessment Consumer Verification via Selfie dated 06 February 2020. ↩
-
Id. ↩
-
National Privacy Commission, Implementing Rules and Regulations of the Data Privacy Act of 2012, rule IV, §19 D(3) (2016). ↩
-
Grab Philippines Compliance and Motion to Lift Cease-and-Desist Order dated 22 June 2021. ↩
-
National Privacy Commission, NPC Advisory 17-03, 31 July 2017, Guidelines on Privacy Impact Assessment, at p. 5. ↩