NPC Issuance Wiki

NPC CC 20-001: In re: Grab Philippines

Issued Order

Order Text

IN RE: GRAB PHILIPPINES NPC CC 20-001

x----------------------------------------------------x

ORDER

Before the Commission is Grab Philippines’ (Grab PH) Motion for Reconsideration (Motion) dated 18 December 20231 to the Order of the Commission dated 17 August 2023.2

In an Order dated 17 August 2023, the Commission denied Grab PH’s Motion to Resolve (Re: Compliance and Motion to Lift Cease-and-Desist Order dated 3 February 2020) and directed Grab PH to delete within three (3) months the personal data of its previous clients with deactivated accounts.3 The dispositive portion of the Order reads:

WHEREFORE, premises considered, the Commission hereby:

  1. DENIES the Grab Philippines’ (Grab PH) Motion to Resolve (Re: Compliance and Motion to Lift Cease-and-Desist Order dated 3 February 2020) dated 02 August 2023;

  2. DIRECTS Grab PH to DELETE within three (3) months, the personal data of its previous clients with deactivated accounts and to SUBMIT proof of such deletion to the Compliance and Monitoring Division (CMD); and,

  3. DIRECTS the CMD to issue the appropriate orders to monitor the completeness of Grab PH’s data breach notification and assess its breach management pursuant to NPC Circular 16-03 (Personal Data Breach Management).

SO ORDERED.4

In denying Grab PH’s Motion to Resolve, the Commission stated:

For the Commission, excessive retention period may lead to having an inaccurate, irrelevant, and out-of-date personal data. In this regard, the Commission finds the 40-year retention period of Grab PH to be excessive for failure to justify the same by showing legal basis of such period, and that such retention is legitimate.5

On 01 December 2023, Grab PH’s counsel received a copy of the 17 August 2023 Order of the Commission.6 Consequently, Grab PH sought for the reconsideration of the Commission’s above Order on the denial of its Motion to Resolve (Re: Compliance and Motion to Lift Cease-and-Desist Order dated 3 February 2020) dated 02 August 2023.7 Grab PH stated that:

In consideration of the Honorable Commission’s findings above, and in its efforts to uphold the data privacy rights of its data subjects and, at the same time, address the primordial safety and security concerns of its partner-drivers and passengers, Grab reduced the retention period for Selfie data of users who committed heinous crimes, such as murder, rape, armed robbery, physical or sexual assault, and theft, from a maximum of forty (40) years to a maximum of ten (10) years. A copy of the revised Privacy Impact Assessment for the Consumer Verification via Selfie Project (“PIA PAX Selfie”) is attached hereto as Annex “B”, for this Honorable Commission’s consideration and approval.8

According to Grab PH, the 10-year retention period is consistent with the provisions of Rule IV, Section 19 of Implementing Rules and Regulations (IRR) of the Data Privacy Act of 2012 (DPA) which states:

… d. Personal Data shall not be retained longer than necessary:

  1. Retention of personal data shall only for as long as necessary:

(a) for the fulfillment of the declared, specified, and legitimate purpose, or when the processing relevant to the purpose has been terminated;

(b) for the establishment, exercise or defense of legal claims; or

(c) for legitimate business purposes, which must be consistent with standards followed by the applicable industry or approved by appropriate government agency.9

In citing the above provision, Grab alleged that the said period “is necessary for the declared, specified, and legitimate purpose of processing, which is primarily to ensure the safety and security concerns of Grab’s partner-drivers and passengers.”10

Moreover, Grab PH justified the 10-year retention period by asserting that its “partners-drivers are in close contact with the passengers” thus “increasing the risk of safety and security concerns.”11 Grab PH added that such safety and security concerns are supported by internal reports from Grab in relation to its Selfie Project.12 According to Grab PH:

Based on the reports, users related to safety incidents (i.e., committed crimes or violated the Grab Code of Conduct) continue to attempt to reenter the platform at least four (4) years from the revocation of their accounts.

xxx

In the recorded instances, Grab was, in fact, able to prevent users who committed heinous crimes or violated the Grab Code of Conduct from accessing the platform after their accounts were revoked. Thus, it cannot be said that the fulfilment of the purpose of the Selfie Pax feature is not clearly defined and purely hypothetical.13

Further, Grab PH stated that its Selfie Project will help assist the law enforcement authorities in their investigation and enforcement functions, citing the Commission’s Advisory Opinion No. 2017-024 which provides that “prescription periods under existing laws may be considered as one of the factors in determining retention periods for personal data.”14

Grab PH added that Revised Penal Code provides for the maximum prescriptive period of twenty (20) years from the discovery of the crime, specifically those crimes punishable by reclusion perpetua and reclusion temporal.15

In that instance, Grab PH stated that:

[T]he Selfie data generated will be used to identify users in the event of occurrence of a criminal incident in the course of use or provision of any of the Grab services. It will also be used to prevent users whose access to Grab Services have been revoked (due to past criminal acts on the platform or violation of the Grab Code of Conduct) from creating new Grab accounts. Should criminal incidents take place, photos of users suspected of committing a crime by law enforcement authorities may be released to the latter, subject to official request / subpoena being presented.16

Thus, Grab PH concluded it has legal basis to retain the Selfie data for ten (10) years specifically for purposes of investigation and enforcement by law enforcement authorities.17

Furthermore, Grab PH cited personal information controllers (PICs) whose photo verification retention period are publicly available online.18 Grab PH stated that “there is no specific or fixed minimum or maximum retention periods for Selfie data. The same shall be retained for as long as necessary to fulfill of the purposes for which the Selfie data was obtained.”19 Thus, Grab PH submits that the 10-year retention period of the Selfie data is reasonable and lawful.20

NPC Advisory No. 2017-03 or the Guidelines on Privacy Impact Assessment provides:

A Privacy Impact Assessment (PIA) helps a PIC and PIP navigate the process of understanding the personal data flows in the organization. It identifies and provides an assessment of various privacy risks, and proposes measures intended to address them.

The identification of risks and the use of a control framework for risk management should consider existing laws, regulations, and issuances relevant to privacy and data protection, as well as the rights of data subjects. The most appropriate standard recognized by the sector or industry of the PIC or PIP, as well as that of the information and communications technology industry shall also be considered.21 (Emphasis supplied)

In its Motion, Grab PH attached its revised PIA for the Consumer Verification via Selfie Project which contains provisions on the retention of the selfie data.22 Grab PH’s PIA provides:

Consumer Selfie data retention periods are as follows:

  1. Retain the selfie only until the prescribed retention period after the Consumer requested for the account to be deactivated.

  2. Retain the selfie until Consumer becomes a dormant user (i.e., the consumer has no transaction with Grab for more than 180 days)

  3. Retain the Consumer selfie for the Consumers who are related to safety incidents. The data of Consumers involved in safety incidents are retained as long as Grab or its affiliate/successor offers its services to the public. We need to retain the data because if the Consumer decides to come back and create another account in the future, if an account has been blocked that has a safety incident, the Consumer will not be able to create it based on the selfie. We will retain the data of consumers involved in safety incidents for as long as it is necessary to fulfill the purposes for which it was obtained or for the establishment, exercise or defense of legal claims, or for legitimate business purposes, or as provided by law.

Unless otherwise specified or required by law, the maximum retention duration of the Sefie [sic] (those involved in safety incidents) shall not exceed 10 years from the date of original collection.23

While Grab PH’s PIA provided for provisions on the retention period of the Selfie data, it, however, failed to clearly indicate whether the Selfie data are retained “as long as it is necessary to fulfill the purposes for which [they were] obtained,” or to retain them with a maximum period of 10 years.

Following the principle of proportionality under the DPA and its Implementing Rules and Regulations, the “processing of information shall be adequate, relevant, suitable, necessary, and not excessive in relation to a declared and specified purpose.”24

According to Grab PH, the 10-year retention period of the Selfie data, shall fulfil its purposes for safety and security, as well as the assistance to law enforcement authorities in their investigation and enforcement functions.25 However, as worded, Grab PH’s PIA is unclear whether the Selfie data shall be retained as long as it is necessary to fulfill its purpose, or within a maximum period of 10 years. This is a violation of the proportionality principle of data privacy.

The retention period should be reckoned from the time the users’ account with Grab PH has been terminated and not from the time of collection of personal data. In this way, the personal data are ensured to not be retained indefinitely by Grab PH.

Thus, in order for the Commission to assess the submissions made, the PIA submitted by Grab PH shall be endorsed to the Compliance and Monitoring Division (CMD) to evaluate the same and to make necessary orders for Grab PH to comply with.

WHEREFORE, premises considered, the Commission hereby:

  1. DIRECTS the Compliance and Monitoring Division (CMD) to EVALUATE Grab Philippines’ (Grab PH) Privacy Impact Assessment (PIA) and to issue the appropriate orders for Grab PH to submit its compliance directly to the CMD; and,
  2. DIRECTS CMD to EVALUATE the compliance of Grab PH upon its submission and thereafter, ENDORSE such evaluation to the Commission en banc.

SO ORDERED.

City of Pasay, Philippines. 08 January 2024.

JOHN HENRY D. NAGA Privacy Commissioner

WE CONCUR:

LEANDRO ANGELO Y. AGUIRRE Deputy Privacy Commissioner

NERISSA N. DE JESUS Deputy Privacy Commissioner

Copy furnished:

DG Data Protection Officer Grab Philippines

QT Counsel for Grab Philippines

COMPLIANCE AND MONITORING DIVISION ENFORCEMENT DIVISION GENERAL RECORDS UNIT

Footnotes

  1. Motion for Reconsideration dated 18 December 2023 of Grab Philippines. ↩

  2. In re: Grab Philippines, NPC CC 20-001, Order dated 17 August 2023. ↩

  3. Id., at p. 5. ↩

  4. Id. ↩

  5. Id. ↩

  6. Motion for Reconsideration dated 18 December 2023 of Grab Philippines, at p. 1. ↩

  7. Id. ↩

  8. Id., at p. 2. ↩

  9. An Act Protecting Individual Personal Information in Information and Communications Systems in the Government and the Private Sector, Creating for This Purpose a National Privacy Commission, and for Other Purposes [Data Privacy Act of 2012], Republic Act No. 10173; see also National Privacy Commission, Implementing Rules and Regulations of the Data Privacy Act of 2012, rule IV, § 19(d) (2016). ↩

  10. Motion for Reconsideration dated 18 December 2023 of Grab Philippines, at p. 3. ↩

  11. Id. ↩

  12. Id. ↩

  13. Id., at pp. 3-4. ↩

  14. Motion for Reconsideration dated 18 December 2023 of Grab Philippines, at p. 4. ↩

  15. Id. ↩

  16. Id., at pp. 4-5. ↩

  17. Id., at p. 5. ↩

  18. Motion for Reconsideration dated 18 December 2023 of Grab Philippines, at p. 5. ↩

  19. Id. ↩

  20. Id. ↩

  21. National Privacy Commission, Guidelines on Privacy Impact Assessments, NPC Advisory 2017-03, in General Principles (31 July 2017) (NPC Advisory 2017-03). ↩

  22. Motion for Reconsideration dated 18 December 2023 of Grab Philippines, referred to as Annex “B” at p. 15. ↩

  23. Id. ↩

  24. An Act Protecting Individual Personal Information in Information and Communications Systems in the Government and the Private Sector, Creating for This Purpose a National Privacy Commission, and for Other Purposes [Data Privacy Act of 2012], Republic Act No. 10173, chapter III, § 11 (2012); see also Implementing Rules and Regulations of the Data Privacy Act of 2012, rule IV, § 18(c) (2016). ↩

  25. Motion for Reconsideration dated 18 December 2023 of Grab Philippines, at p. 3. ↩

Backlinks

  • No backlinks found