NPC Issuance Wiki

NPC CC 20-001: In re: Grab Philippines

Issued Resolution

Resolution Text

IN RE: GRAB PHILIPPINES

x----------------------------------------------------x

NAGA, P.C.;

Before the Commission is the Urgent Motion to Lift Cease-and-Desist Order dated 03 February 2020 filed by Grab Philippines (Grab PH) dated 04 June 2024.1

Facts

To recall, the Commission issued a Cease-and-Desist Order (CDO) dated 03 February 2020 on the roll-out and pilot testing of Grab PH’s three new data processing systems (DPS), namely: Passenger Selfie Verification, In-Vehicle Audio Recording, and In-Vehicle Video Recording.2 The Commission stated in the CDO that:

In DASCO Notice of Deficiencies dated 31 January 2020, it was clearly established that Grab PH’s three (3) new data processing systems’ risk assessment and mitigation are lacking, the PIA and privacy notice are insufficient, and the purpose of data processing itself is unclear. Further, in DASCO Memorandum dated 31 January 2020, it was stated that, “maintaining the status quo, wherein Grab PH is engaged in the collection and processing of passenger personal information through the processing systems in question, would further expose the fundamental rights and freedoms of the concerned data subjects to detrimental risks.”

While this Commission believes that the security of passengers and drivers is a primordial concern, their privacy rights must not be disregarded. It must be protected with earnestness by ensuring that the purpose of data processing is clearly stated, the data flow is secured, and the risks are properly identified and mitigated. Absent these safeguards, this Commission will always adhere in protecting the privacy rights of the data subjects.3

Thereafter, Grab PH submitted its Report/Compliance (to Notice of Deficiencies dated 31 January 2020 and Cease and Desist Order dated 3 February 2020) dated 18 February 2020 praying for the approval of its Privacy Impact Assessments (PIAs) for In-Vehicle Audio Recording and Passenger Verification via Selfie, Grab PH’s Privacy Notice, Data Protection Handbook, and Privacy Manual/Privacy Policy.4 Grab PH also prayed for the lifting of the CDO with respect to its DPS on vehicle-audio recording and passenger selfie verification.5 However, the Commission issued a Resolution dated 19 November 2020, denying Grab PH’s prayers and resolving that the CDO shall remain in effect until it fully satisfies the requirements of the Commission.6

On 22 June 2021, Grab PH submitted its Compliance and Motion to Lift Cease-and-Desist Order dated 03 February 2020 submitting its revised PIA on the Consumer Verification via Selfie, and thus praying for the lifting of CDO with respect to the said Consumer Verification via Selfie.7

On 19 January 2022, Grab PH filed its Motion to Resolve (Re: Compliance and Motion to Lift Cease-and-Desist Order dated 3 February 2020) requesting that the Commission separately resolve the matter on (a) Consumer Verification via Selfie project, and (b) In-Vehicle Audio Recording project.8 In the said submission, Grab PH prayed for (1) the resolution of the Compliance and Motion to Lift CDO filed on 22 June 2021; (2) lifting the CDO with respect to the Consumer Selfie Verification project; and, (3) identifying any further action required as regards In-Vehicle Audio Recording project.9

On 03 February 2022, the Commission issued a Resolution noting Grab PH’s Motion to Resolve (Re: Compliance and Motion to Lift Cease-and-Desist Order dated 3 February 2020) dated 19 January 2022.10 The Commission, in the said Resolution, also required Grab PH to submit its PIA for the In-Vehicle Audio Recording.11

On 03 March 2022, Grab PH submitted a Manifestation (Re: Resolution dated 03 February 2022) stating that for commercial reasons, it has indefinitely suspended the implementation of the In-Vehicle Audio Recording and In-Vehicle (CCTV) Recording projects, requesting further that the submission of their PIAs be forgone.12 Grab PH manifested that “should it decide in the future to implement the In-Vehicle Audio Recording and In-Vehicle Video (CCTV) Recording projects, it will submit the PIA of the said projects for the approval of this Honorable Commission before implementing the projects.”13

Lastly, Grab PH manifested that it will only implement the Consumer Verification via Selfie project as soon as the CDO is lifted by the Commission, thus reiterating its request for the approval of the PIA of the said project.14

On 19 January 2023, the Commission issued an Order requiring Grab PH to comply with the following:

WHEREFORE, premises considered, the Commission hereby ORDERS Grab Philippines to:

  1. REVISE the retention period involving consumer selfie of individuals involved in safety incidents and SUBMIT the revised PIA incorporating such;

  2. SUBMIT the documents detailing the secure manner of disposal of the consumer selfie upon deletion from the AWS S3 system; and

  3. INCLUDE AWS S3 in the next conduct of Privacy Impact Assessment to ensure that all possible risks are addressed. If AWS S3 conducts its own PIA, consider appending the same to Grab PH’s PIA.

Grab PH shall SUBMIT its compliance with the aforementioned directives of the Commission directly to the Compliance and Monitoring Division (CMD) within fifteen (15) days upon receipt of this Order.

SO ORDERED.15

In the said Order, the Commission deemed it necessary to require Grab PH to remediate the issues found in its PIA for the Consumer Verification via Selfie.16 According to the submitted PIA, Grab PH indicated that the Selfie data “may be retained as long as necessary if it is related to safety incidents.”17 However, the Commission stated that the retention of the selfie data for an indefinite period is contrary to the Data Privacy Act of 2012 (DPA).18 Thus, the Commission required Grab PH to revise its PIA on the retention period in accordance with the DPA.19

Moreover, as observed by the Commission, Grab PH’s PIA indicated that the “disposal of selfie data stored in AWS S3 is done by the Grab Database Team, upon request and approval from Grab Safety Engineering Team.”20 Also, the PIA stated that the selfie data will be disposed if the same is requested by the Consumer or the removal thereof is due to the Consumer’s inactive account, unless the account is related in safety incidents.21

Based on the foregoing, the Commission stated that the PIA did not mention whether the selfie data would be permanently stored on AWS S3 servers, and that there is uncertainty on “whether the safe disposal of selfie data on the records is manifested in some other document.”22 Therefore, the Commission required Grab PH to “submit in detail the secure manner of disposal of the consumer selfie upon its deletion from the AWS S3 system.”23

On 14 March 2023, Grab PH filed a Motion for Extension of time to file its compliance with the Order of the Commission dated 19 January 2023.24

On 30 March 2023, the Commission issued an Order granting Grab PH’s Motion for Extension of Time to Comply, as well as requiring Grab PH to submit its compliance until 05 April 2023.25

Accordingly, Grab PH submitted its Compliance with Motion to Lift CDO dated 05 April 2023, attaching therein its revised/updated PIA for the Consumer Verification via Selfie project.26 In the said revised/updated PIA, Grab PH indicated:

…We will retain the data of consumers involved in safety incidents for as long as it is necessary to fulfill the purposes for which it was obtained or for the establishment, exercise or defense of legal claims, or for legitimate business purposes, or as provided by law.

Unless otherwise specified or required by law, the maximum retention duration of the Selfie (those involved in safety incidents) shall not exceed 40 years from the date of original collection.27

Grab PH claimed that “the above mentioned retention period is compliant with the retention principle under the DPA.”28 Grab PH believed that “it is necessary to retain the consumer selfie of individuals involved in safety incidents for up to 40 years in order to ensure the safety of all the other users on its platform,”29 and that the implementation of a shorter retention period “may endanger and put other users of Grab’s platform at risk, which would not be in line with the safety standards that Grab has imposed upon itself.”30

Moreover, as regards the disposal or destruction of Selfie data stored in the AWS S3 system, Grab PH clarified that it can no longer recover selfie data once deleted in Amazon S3 since Grab PH “is not subscribed to S3 versioning and does not have backups of the selfie data.”31 Grab PH added that:

…[It] will delete the selfie data after the consumer account has been marked for deactivation (subject to Grab’s Data Retention Policy), unless the account is related or involved in any safety incidents, in which case their selfie data may be retained by Grab for up to 40 years. Once the selfie data is deleted, Grab can no longer recover the same, as discussed above.32

Lastly, as to the PIA on AWS S3, Grab PH stated that it has not reached out to AWS when it conducted the PIA, AWS has provided Grab PH an attestation on their security and privacy posture.33

On 11 May 2023, the Commission issued a Resolution noting the 05 April 2023 compliance submitted by Grab PH.

On 02 August 2023, Grab PH submitted its Motion to Resolve justifying the 40-year retention period by stating that:

[T]he Consumer Verification via selfie serves as the only enduring parameter within which the legitimate interests of Grab PH users—both driver-partners and consumers—can be protected since other modes of verification can easily be manipulated or become inaccurate after a period of time. For instance, users do not often use their legal name, and mobile numbers linked with accounts may be recycled by telephone companies.

[…] To reiterate, Grab PH is constrained to retain Selfie data for a maximum of forty (40) years from the date of collection as this is the only method by which Grab PH can achieve its safety objective, i.e. ensure the users who have had a history of criminal acts and/or grave violations of Grab PH’s terms are absolutely prevented from accessing the platform in the future.34

Thus, Grab PH prayed that its Compliance and Motion to Lift CDO filed on 22 June 2021 be resolved by the Commission.35

Thereafter, the Commission issued an Order dated 17 August 2023 stating that:

While the DPA and its IRR does not provide for a specific data retention period, personal information controllers (PIC), like Grab PH in this case, should be guided by the general data privacy principles of transparency, legitimate purpose, and proportionality, among others. This means that PICs must have declared, specified, and legitimate purpose in retaining the personal data for a particular period.

In this case, Grab PH stated that the 40-year retention period is for the purpose of ensuring that the “users who have had a history of criminal acts and/or grave violations of Grab PH’s terms are absolutely prevented from accessing the platform in the future.” While Grab PH has declared, specified, and legitimate purpose to retain the selfie data for 40 years, however, the desired retention period is not consistent with the standards of the Commission. For the Commission, the 40-year retention period is excessive as the same has no legal basis under the laws of the Philippines.

The 40-year retention period of the selfie data should be established by or referred to, a specific legal basis. Considering that the selfie data are collected based on consent, the retention of the same should not be made excessively especially when the fulfillment of its purpose is not clearly defined and is purely hypothetical. The assertion that the retention period will absolutely prevent the users who committed heinous crimes “from accessing the platform in the future,” is purely hypothetical and holds no legal basis. Thus, Grab PH cannot retain the selfie data it previously held and it intends to collect for the implementation of the Consumer Verification via Selfie.

For the Commission, excessive retention period may lead to having an inaccurate, irrelevant, and out-of-date personal data. In this regard, the Commission finds the 40-year retention period of Grab PH to be excessive for failure to justify the same by showing legal basis of such period, and that such retention is legitimate.36

Thus, the Commission denied the Motion to Resolve and directed Grab PH to delete the personal data of its previous clients with deactivated accounts, to wit:

WHEREFORE, premises considered, the Commission hereby:

  1. DENIES the Grab Philippines’ (Grab PH) Motion to Resolve (Re: Compliance and Motion to Lift Cease-and-Desist Order dated 3 February 2020) dated 02 August 2023;

  2. DIRECTS Grab PH to DELETE within three (3) months, the personal data of its previous clients with deactivated accounts and to SUBMIT proof of such deletion to the Compliance and Monitoring Division (CMD); and,

  3. DIRECTS the CMD to issue the appropriate orders to monitor the completeness of Grab PH’s data breach notification and assess its breach management pursuant to NPC Circular 16-03 (Personal Data Breach Management).

SO ORDERED.37

Subsequently, Grab PH filed its Motion for Reconsideration (MR) dated 18 December 2023 reducing the retention period for the Selfie data of users from forty (40) to ten (10) years.38 Grab PH also stated therein that the Selfie Project will assist law enforcement authorities in their investigation and enforcement functions, in consonance with the Commission’s Advisory Opinion No. 2017-024 which provides that “prescription periods under existing laws may be considered as one of the factors in determining retention periods for personal data.”39 Grab PH concluded that the 10-year retention period for the Selfie data has legal basis specifically for purposes of investigation and enforcement by law enforcement authorities.40

In resolving the MR, the Commission issued an Order dated 08 January 2024 stating that:

Following the principle of proportionality under the DPA and its Implementing Rules and Regulations, the “processing of information shall be adequate, relevant, suitable, necessary, and not excessive in relation to a declared and specified purpose.”

According to Grab PH, the 10-year retention period of the Selfie data, shall fulfil its purposes for safety and security, as well as the assistance to law enforcement authorities in their investigation and enforcement functions. However, as worded, Grab PH’s PIA is unclear whether the Selfie data shall be retained as long as it is necessary to fulfill its purpose, or within a maximum period of 10 years. This is a violation of the proportionality principle of data privacy.

The retention period should be reckoned from the time the users’ account with Grab PH has been terminated and not from the time of collection of personal data. In this way, the personal data are ensured to not be retained indefinitely by Grab PH.41

Thus, the Commission directed the Compliance and Monitoring Division (CMD) to evaluate Grab PH’s PIA and to issue the appropriate orders necessary for Grab PH’s compliance.42

Meanwhile, on 04 June 2024, Grab PH submitted its Urgent Motion to Lift Cease-and-Desist Order dated 3 February 2020.43 Grab PH averred the following:

  1. The factual or legal basis for which the CDO was issued no longer exists as Grab PH has addressed all issued in the [Notice of Deficiencies] NOD and any subsequent recommendation by the Commission.44

  2. There is an urgent need to lift the CDO and implement the Passenger Selfie and Audio Protect features.45

  3. Processing of personal data will not be detrimental to national security or public interest but is necessary to protect the rights of data subjects.46

In addressing the basis for the issuance of the CDO, Grab PH stated that it “has discussed at length the privacy controls it has put in place such as limited retention and disclosure as well as security measures like encryption and restricted access controls.”47 Grab PH further argued that this reduction of the retention period “is in line with the principles of accuracy and storage limitation” under the DPA.48

Moreover, Grab PH averred that, for four years, it has “complied in good faith and worked earnestly to ensure that the directives of the Honorable Commission are implemented, demonstrating a strong commitment to data privacy,” aligning its policies and procedures with the DPA, its IRR, and other NPC issuances.49

As to the urgency of lifting the CDO of the Consumer Verification Selfie project, Grab PH emphasized that “in recent years, several incidents have underscored the grave risks faced by driver-partners and passengers necessitating the urgent implementation of Grab PH’s Safety Features.”50 Grab PH also stated that in 2024, it “received reports on several unfortunate incidents of carnapping, armed robberies, and even attempted rape.”51 To substantiate this claim, Grab PH attached in the same Motion the incident reports containing recent cases of the above stated incidents.52

In addition to the incident reports, Grab PH pointed out that “there has been an increased clamor from driver communities for enhanced security measures to safeguard their wellbeing and livelihood. These alarming incidents not only pose grave threats to safety of driver-partners but also undermine the public’s trust in the ride-hailing industry.”53

In light of these concerns, Grab PH argued that “any further delay in lifting the CDO over such a vital safety feature only undermines efforts to enhance accountability and trust within the transportation sector.”54

Finally, Grab PH stated that the processing of Consumer Passenger Verification Selfie data is necessary to protect the rights of data subjects.55 In this context, Grab PH averred that:

[It] has an ethical responsibility to implement suitable and available safety features,” and that “[t]his is essential not only to prevent harm but also to cultivate trust and inspire confidence among the individuals it seeks to serve. Grab PH endeavored to strike a delicate balance between the public’s demand for enhanced security features and the individuals’ right to privacy. Privacy will never take a back seat at Grab, but the importance of other equally pressing matters, such as the lives and security of driver-partners and passenger-users, need to be protected as well.56

Grab PH thus prayed that the Commission issue an Order lifting the CDO dated 20 February 2024.57

On 20 August 2024, Grab PH submitted its Manifestation (to Order dated 8 January 2024) stating that there is no necessity for the Commission to endorse the review of Grab PH’s PIA to the CMD considering that during the On-Site Visit (OSV) on 21 February 2024, the CMD agreed to the 10-year retention period of the Selfie data.58 In this regard, Grab PH claimed that the CMD issued a Certificate of No Significant Findings, “a testament to the fact that Grab PH has already addressed all deficiency findings earlier identified to the satisfaction of the National Privacy Commission (NPC).”59 Grab PH also averred that “another revision of the PIA is no longer necessary because the current PIA is already in compliance with applicable privacy laws.”60

As mentioned by Grab PH, the 10-year period to retain the Selfie data is in compliance with the principle of proportionality.61 As such, Grab PH averred that:

[It] has determined that the retention period of 10 years from the time of selfie collection is necessary to achieve the purposes discussed above. This determination is based on the following factors: (1) data of re-entry attempts of previous violators; (2) prescription period under the Revised Penal Code; (3) industry practice; and (4) accuracy of the selfie, taking into consideration the passage of time. Grab PH has specified a definite period for retention which complies with the data retention limitation principle.62

According to Grab PH, its PIA provided multiple scenarios where it will retain the Selfie data such as: Active Grab User, Deactivated (or terminated User), Dormant User (no transaction within 180 days), and Users involved in safety incidents.63 Grab PH stated that:

In all these scenarios, the selfie data will be retained for a maximum period of 10 years taking into consideration the factors described above. The retention period will be reckoned from the time of collection and not from the time of termination, deactivation or dormancy. This period will allow for a shorter retention period and will ensure that Grab PH will not be retaining the data indefinitely in accordance with principles proportionality and retention limitation.64

Grab PH insisted that:

[P]roportionality and retention are distinct obligations that Grab PH has already complied with. As such, there is no basis to remand the review of the PIA to the CMD. Because of this, NPC’s finding that the PIA did not specifically state that the selfie data are retained “as long as it is necessary to fulfill the purposes for which [they were] obtained,” or “retain them with a maximum period of 10 years” thus violating proportionality is incorrect.65

Nevertheless, Grab PH alleged that if the Commission deems that retention is subsumed under the principle of proportionality, Grab PH is still compliant considering that the 10-year retention period of Selfie data “originally collected will no longer be “adequate, relevant, suitable, necessary, and not excessive” in relation to purposes of user verification, crime deterrence, law enforcement assistance and prevention of violators from re-entering the platform unless Grab PH take steps to re-collect selfies of active users after the lapse of 10 years.”66 As such, if the Selfie data were not recollected after ten (10) years, these data will become obsolete and outdated.67

Lastly, Grab PH submitted that it would follow the 10-year retention period following the principle of accuracy under Section 11(c) of the DPA.68 As stated by Grab, following the Commission’s discussion in its previous Order, “after 10 years, the selfie initially collected may no longer be accurate because of the changes in facial features of individuals as they age.”69 In this case, the data will no longer be relevant to the purposes for which they were initially collected.70

Thus, in order to ensure accuracy, Grab PH “has put in place controls to immediately delete the selfie 10 years after collection, regardless of the user status, unless it is required by law to retain the data, such as when cases are filed in court.”71

Issue

Whether the Cease-and-Desist Order dated 03 February 2020 should be lifted.

Discussion

The DPA focuses on protecting people’s privacy rights, setting rules for data protection, and encouraging openness among organizations.72 In enforcing privacy principles, a personal information controller (PIC) must put in place reasonable and appropriate organizational, physical, and technical measures to protect personal data.73

Moreover, a PIC has the obligation to collect personal information for specified and legitimate purposes only, collect and process the same adequately and not excessively.74 Personal information should be accurate, relevant, and up-to-date, and retained only for as long as necessary for the fulfillment of the purposes for which it was obtained.75

In light of Grab PH’s adherence to the general privacy principles, and compliance with its obligations under the DPA and the Commission’s directives, the Commission lifts the CDO dated 03 February 2020 as to the Passenger Selfie Verification Project.

Grab PH has complied with the general data privacy principles under the DPA when it established the Selfie Verification Project’s risk assessment and mitigation as well as its revised PIA and Privacy Notice.

In issuing the CDO dated 03 February 2020 on the roll-out of the Passenger Selfie Verification Project, the Commission established that Grab PH’s three new DPS lacked proper risk assessment and mitigation, the PIA and privacy notice were insufficient, and the purpose of data processing was unclear.76

On 18 December 2023, Grab PH submitted its revised PIA for Consumer Verification via Selfie.77 Grab PH described the purposes of the Consumer Verification which are:

  1. Maintain safety of the platform for the drivers. Consumer selfie will help eliminate bogus/fake Consumer accounts that do not have a registered credit/debit card. This will replace the linking of Facebook accounts that we find ineffective since Facebook can be created with fake information (such as profile name and profile picture). This will also help in managing the behavior of the app user by creating psychological deterrence as selfie is an effective component of a good verification process.

  2. Assist the authorities (e.g., Law Enforcement Agency) by providing the requested information of the Consumers for the purpose of its investigation.

  3. Prevent Consumers who have previously committed criminal acts while using Grab’s platform, or otherwise violated the Grab Code of Conduct which resulted in their access to Grab services being revoked, from creating a new Grab account(s).78

Grab PH likewise provided a summary of the process by which the selfie data is being stored in its database.79 Grab PH stated:

During the selfie process, Consumers will be asked to look at the camera, position their face within the circle seen on the screen, and once their face has been detected, Consumers will be asked to complete a gesture, i.e. nod their head. The system utilizes a technology to detect persons’ liveness to prevent spoofing by presenting pictures of a face, wearing a mask, using video feed, etc.

Upon successful completion, the Consumer’s selfie is stored in the Grab database. This picture is not being shared with drivers/other Consumers or used for any commercial purposes. It is used only to identify Consumers in the event of occurrence of a criminal incident in the course of use or provision of any of the Grab Services or prevent Consumers whose access to Grab Services have been revoked (due to past criminal acts on the platform or violation of the Grab Code of Conduct (https://www.grab.com/ph/terms-policies/code-of-conduct-consumer) from creating new Grab accounts.

Should criminal incidents take place, photos of Consumers suspected of committing a crime by law enforcement authorities may be released to the latter, subject to official request / subpoena being presented.80

As to the scope and extent of the Consumer Verification via Selfie, Grab PH categorized its consumers as follows:

  1. New Consumers: No prior transaction on either Grab Transport or Grab Express service on Grab App

  2. Unverified Dormant Consumers: No transaction in the past 180 days on Grab Services, with no verification record with Grab.

  3. Existing Unverified Consumers: Active in the past 180 days on Grab Services, with no prior transaction on either Grab Transport or Grab Express as well as no verification record with Grab.81

Grab PH also requires its consumers “to complete a mandatory one-time verification process prior to Consumers booking their first Grab Services.”82 Grab PH likewise stated that there will be proposed modes of consumer verification in the Philippines: (1) Collection of Selfie; and (2) Registration of cashless payment which, upon adding the bank record, will be seen as verified.83 Grab PH stated that the bank card details added by the consumer will not be provided to local law enforcement.84 As to the selfies collected, Grab PH claimed that they will only be used to:

[I]dentify Consumers in the event of occurrence of a criminal incident in the course of use or provision of any of the Grab Services or platform, and prevent Consumers whose access to Grab Services have been revoked (due to past criminal acts on the platform or violation of the Grab Code of Conduct) from creating new Grab account(s).85

As part of the verification flow in the Grab application and prior to the collection of other personal data, consent is obtained from the consumers.86 Grab PH, nevertheless, declared that consumers have the right to decline providing their selfie data and may elect to verify their identity by the registration of cashless payment using the Grab application.87 However, Grab PH insisted that since “only around 25% of the Philippines adult population has a credit/debit card,” the Consumer Verification via Selfie is an alternative when the consumers opt to pay in cash.88

B. The selfie data collected are stored on AWS S3 servers.

According to Grab PH, the selfie data being collected shall be stored on AWS S3 servers located in Singapore, which only the Grab Safety Engineering Team has “read-only” access.89 Grab PH added that only its Database Team has “Update Access” to the AWS S3.90

C. Retention of selfie data has been revised from 40 years to 10 years, following the general privacy principle of proportionality.

In its Motion to Lift CDO dated 05 April 2023, Grab PH attached therein its revised/updated PIA for the Consumer Verification via Selfie project.91 In the said revised/updated PIA, Grab PH indicated:

…We will retain the data of consumers involved in safety incidents for as long as it is necessary to fulfill the purposes for which it was obtained or for the establishment, exercise or defense of legal claims, or for legitimate business purposes, or as provided by law.

Unless otherwise specified or required by law, the maximum retention duration of the Selfie (those involved in safety incidents) shall not exceed 40 years from the date of original collection.92

Grab PH claimed that the 40-year retention period is compliant with the DPA, and that the implementation of a shorter retention period “may endanger and put other users of Grab’s platform at risk, which would not be in line with the safety standards that Grab has imposed upon itself.”93

In an Order dated 17 August 2023, the Commission stated that 40-year retention period is excessive as the same has no legal basis under the laws of the Philippines.94 The Commission further stated that:

The 40-year retention period of the selfie data should be established by or referred to, a specific legal basis. Considering that the selfie data are collected based on consent, the retention of the same should not be made excessively especially when the fulfillment of its purpose is not clearly defined and is purely hypothetical. The assertion that the retention period will absolutely prevent the users who committed heinous crimes “from accessing the platform in the future,” is purely hypothetical and holds no legal basis. Thus, Grab PH cannot retain the selfie data it previously held and it intends to collect for the implementation of the Consumer Verification via Selfie.

For the Commission, excessive retention period may lead to having an inaccurate, irrelevant, and out-of-date personal data. In this regard, the Commission finds the 40-year retention period of Grab PH to be excessive for failure to justify the same by showing legal basis of such period, and that such retention is legitimate.95

Accordingly, Grab PH submitted that following the Commission’s discussion in its previous Order, “after 10 years, the selfie initially collected may no longer be accurate because of the changes in facial features of individuals as they age.”96

Consequently, Grab PH has established in its PIA the following retention periods of the selfie data:

Consumer Selfie data retention periods are as follows:

  1. Retain the selfie only until the prescribed retention period after the Consumer requested for the account to be deactivated.

  2. Retain the selfie until Consumer becomes a dormant user (i.e., the consumer has no transaction with Grab for more than 180 days)

  3. Retain the Consumer selfie for the Consumers who are related to safety incidents. The data of Consumers involved in safety incidents are retained as long as Grab or its affiliate/successor offers its services to the public. We need to retain the data because if the Consumer decides to come back and create another account in the future, if an account has been blocked that has a safety incident, the Consumer) will not be able to create it based on the selfie. We will retain the data of consumers involved in safety incidents for as long as it is necessary to fulfill the purposes for which it was obtained or for the establishment, exercise or defense of legal claims, or for legitimate business purposes, or as provided by law.

Unless otherwise specified or required by law, the maximum retention duration of the Selfie (those involved in safety incidents) shall not exceed 10 years from the date of original collection.97

Thus, the Commission finds that the reduction of the retention period of the Selfie data from forty (40) years to ten (10) years does not violate the proportionality principle under the DPA.

Nevertheless, Grab PH stated in its Manifestation dated 20 August 2024 that the Commission’s findings that its PIA “did not specifically state that the Selfie data are retained “as long as it is necessary to fulfill the purposes for which [they were] obtained,” or “retain them with a maximum period of 10 years” thus violating proportionality is incorrect.”98

Under the proportionality principle enshrined under Chapter II, Section 11 of the DPA:

SEC. 11. General Data Privacy Principles. – The processing of personal information shall be allowed, subject to compliance with the requirements of this Act and other laws allowing disclosure of information to the public and adherence to the principles of transparency, legitimate purpose and proportionality.

Personal information must, be:

…

(c) Accurate, relevant and, where necessary for purposes for which it is to be used the processing of personal information, kept up to date; inaccurate or incomplete data must be rectified, supplemented, destroyed or their further processing restricted;

(d) Adequate and not excessive in relation to the purposes for which they are collected and processed;

(e) Retained only for as long as necessary for the fulfillment of the purposes for which the data was obtained or for the establishment, exercise or defense of legal claims, or for legitimate business purposes, or as provided by law.99

In relation thereto, Rule IV, Section 18(c) of the Implementing Rules and Regulations (IRR) of the DPA states that:

Section 18. Principles of Transparency, Legitimate Purpose and Proportionality. The processing of personal data shall be allowed subject to adherence to the principles of transparency, legitimate purpose, and proportionality.

…

c. Proportionality. The processing of information shall be adequate, relevant, suitable, necessary, and not excessive in relation to a declared and specified purpose. Personal data shall be processed only if the purpose of the processing could not reasonably be fulfilled by other means.100

It can be inferred from the aforementioned provisions that retention and the principle of proportionality are intrinsically interconnected. Retention of the selfie data is deemed processing under the DPA. When selfie data are stored or kept in the system, it is Grab PH’s responsibility to process them in accordance with the purpose necessary for their retention in accordance with the general privacy principle of proportionality.

In revising the retention period to ten (10) years, Grab PH has established through its submissions that such is adequate, relevant, necessary, and not excessive to its declared business and legal purposes. Grab PH stated that the collection and retention of the selfie data will provide “an extra level of verification to protect users.”101 In so stating, such protection to users include assistance to law enforcement authorities in criminal investigations.102

As to the storage of the retained selfie data, Grab PH added that they shall be stored in the servers procured from AWS, which are not shared externally, with the exception of law enforcement authorities, as provided in Grab PH’s PIA on Consumer Verification via Selfie that was attached in the Motion for Reconsideration dated 18 December 2023.103

D. Consumer’s selfie data are disclosed only to authorized persons as determined by Grab PH.

According to Grab PH, the selfie data are disclosed to the following authorized persons:

  1. Grab employees (Grab Safety Team Engineers, Grab Product and Safety Operations team, Tech Support and Grab Support)

  2. Authorized contractors (e.g. outsourced Grab GS agents). Grab GS team consists of contractors and full-time employees. Authorized individuals/teams in Grab CE team are able to view selfie photos via internal portals, i.e. Gamma/Phoenix, if needed. Prior to accessing any confidential information (including personal data), these CE agents are subjected to comply with confidentiality clauses as stipulated in their agreement. They are required to agree to Grab Acceptable Usage Policy prior to logging in into the systems - Phoenix or Gamma[.] Note: Gamma/Phoenix is a Grab internal tool to view consumer information and only authorized personnel with right access can access Gamma/Phoenix tools.

  3. Authorities (law enforcement agents) when an official request, such as police or court summons/subpoenas is presented.104

The Commission finds that by limiting the sharing of data with authorized personnel, contractors, and approved vendors, Grab PH can effectively process and secure the data, as well as perform required verifications as may be necessary to the declared purposes of such disclosure which is in compliance with the general data privacy principles.

The Commission also noted that Grab PH attached the Mutual Non-Disclosure Agreement it executed with AWS which states that “Grab can share confidential information with Government entities as required by law.”105 The same provisions may be found in an agreement entered by Grab PH with Megvii which allows Grab PH to disclose any details to regulators or law enforcement agencies.106

The abovementioned attachments are in relation to Grab PH’s security incident reports “on several unfortunate incidents of carnapping, armed robberies, and even attempted rape.”107 It was also alleged by Grab PH that:

[T]here has been an increased clamor from driver communities for enhanced security measures to safeguard their wellbeing and livelihood. These alarming incidents not only pose grave threats to safety of driver-partners but also undermine the public’s trust in the ride-hailing industry.108

Based on the abovementioned reasons provided by Grab PH, the Commission finds the disclosure of selfie data to authorized persons proper.

E. Grab PH has established a procedure for the disposal and destruction of the selfie data.

In the MR submitted by Grab PH dated 18 December 2023, Grab PH has established that any disposal of the selfie data stored in AWS S3 shall be done by the Grab Database Team, upon request by the Consumer who has not committed a crime or violated Code of Conduct and had account privileges revoked, and approval from the Grab Safety Engineering Team.109 Grab PH has noted that once the selfie data is removed, it can no longer be recoverable.110

Lastly, Grab PH stated that “[s]elfie will be removed after the Consumer account has been marked for deactivation and retained for a specified period of time, per Grab Data Retention Policy, unless the account is related/involved in any safety incidents. If consumers were involved in any safety incidents, their selfie will be kept for a maximum of 10 years.”111

As to the destruction of the selfie data, the same shall be deleted by the Grab Database Team upon request and approval from the Safety Engineering Team.112 Grab PH stated that AWS is not responsible for the deletion/destruction of the selfie data.113 Moreover, Grab PH reported that:

Data in AWS S3, when deleted, is not recoverable, unless a company subscribes to:

• S3 Versioning

An AWS Client can use S3 Versioning to keep multiple versions of an object in the same bucket, which allows it to restore objects that are accidentally deleted or overwritten[.]

• Maintain multiple copies of backups

Grab does not subscribe to S3 Versioning or maintain multiple backup copies for Selfies.114

Grab PH also does not have backups for the selfie data.115 According to Grab PH, AWS has noted that the S3 Versioning must be enabled on the S3 bucket to use AWS Backup for Amazon S3 as this is AWS’ best practice for data protection.116 Grab PH stated that S3 Versioning is not enabled for the Consumer Verification via Selfie project.117

Finally, Grab PH reported that “[f]or the data that is transferred to Megvii (Vendor), Megvii only saves the logs, but not the selfie data. The log data does not contain any PII data. These logs are system log info, such as API response time etc..”118

F. The Privacy Impact Assessment of Grab PH provides for the applicability of the general privacy principles and established security measures.

The Revised PIA attached in the MR dated 18 December 2023 provided and tabulated the observations, recommendations, and a corresponding management action plan related to the general data privacy principles of transparency,119 legitimate purpose,120 and proportionality;121 organizational, physical, and technical security measures;122 and cross-border data flows.123

Regarding the principle of legitimate purpose, Grab PH stated that the purposes for collecting the selfie photos are to:

  1. Maintain safety of the platform for the drivers. Consumers selfie will help eliminate bogus/fake consumer accounts that do not have a registered credit or debit card. This will replace the linking of Facebook accounts that we find ineffective since Facebook can be created with fake information (such as profile name and profile picture). This will also help in managing the behavior of the app user by creating psychological deterrence as selfie is an effective component of a good verification process.

  2. Assist the authorities (for example: Law Enforcement Agency) by providing the requested information of the Consumers for the purpose of its investigation.

  3. Prevent Consumers who have previously committed criminal acts while using Grab’s platform, or otherwise violated the Grab Code of Conduct which resulted in their access to Grab Services being revoked, from creating a new Grab account(s).124

The Commission finds that the circumstances shown justify that Grab PH’s revised PIA is in compliance with the principle of legitimate purpose.

In evaluating the compliance of Grab PH with the principle of legitimate purpose under the data privacy framework, the Commission finds it necessary to assess whether the collection and processing of selfie data of users are aligned with the specified and lawful objectives stated by the company.

First, the collection of selfie data for the purpose of maintaining platform safety is a legitimate and lawful objective by Grab PH.

As mentioned by Grab PH, “in recent years, several incidents have underscored the grave risks faced by driver-partners and passengers, necessitating the urgent implementation of Grab PH’s Safety Features. This year alone, Grab PH received reports on several unfortunate incidents of carnapping, armed robberies, and even attempted rape.”125

Second, Grab PH has stated that the purpose of verification is to “prevent consumers who have previously committed criminal acts while using Grab’s platform, or otherwise violated the Grab Code of Conduct which resulted in their access to Grab services being revoked, from creating a new Grab account(s).”126

In this regard, Grab PH was able to highlight the security risks faced by their drivers and passengers, referencing alarming incidents of criminal activity, including carnapping, armed robberies, and attempted sexual assault. As such, it raises the necessity of verifying the identity of consumers through selfies as a direct and proportionate response to mitigate these dangers thereby serving the legitimate interests of both users and the public at large.

In Grab PH’s PIA Consumer Verification via Selfie dated 06 February 2020, it was originally stated:

The data of Consumers involved in safety incidents are retained as long as Grab or its affiliate/successor offers its services to the public. We need to retain the date because if the Consumer decides to come back and create another account in the future, if an account has been blocked that has a safety incident, the Consumer will not be able to create it based on the selfie.127

In an Order dated 19 January 2023, the Commission considered that while these may be limited to individuals involved in safety incidents, the retention period for an indefinite period is contrary to the DPA.128

In the same Order, the Commission cited the Technical Report of its Compliance and Monitoring Division (CMD) which stated that:

[Grab PH] may consider as the basis of its retention period the prescriptive periods in filing the appropriate action for the resolution of the safety incident in the proper court or forum. Likewise, Grab PH may also consider defining the various gravity of its safety incidents and accordingly adjust the retention period depending on the gravity.129

Thus, the Commission ordered Grab PH to revise the retention period involving consumer selfie of individuals involved in safety incidents and submit the revised PIA incorporating such.130

Consequently, Grab PH submitted its MR dated 18 December 2023 and stated that it revised the retention period of forty (40) years to ten (10) years and is therefore consistent with the DPA and its IRR.131

Additionally, Grab PH anchored the 10-year retention period with the Revised Penal Code which provides for various prescriptive periods for crimes, the maximum of which is twenty (20) years from discovery of the crime, specifically for crimes punishable by reclusion perpetua and reclusion temporal.132 Grab PH alleged that in retaining the selfie data:

[They] will be used to identify users in the event of occurrence of a criminal incident in the course of use or provision of any of the Grab services. It will also be used to prevent users whose access to Grab Services have been revoked (due to past criminal acts on the platform or violation of the Grab Code of Conduct) from creating new Grab accounts suspected of committing a crime by law enforcement authorities may be released to the latter, subject to official request / subpoena being presented.133

The Commission finds that Grab PH’s actions demonstrate compliance with the data privacy principle of proportionality. With the reduction of the retention period on selfie data of users who committed heinous crimes from forty (40) years to a maximum of ten (10) years, Grab PH has ensured that personal data is retained only to ensure the safety and security concerns of Grab PH’s partner-drivers.

This is supported by the Compliance Evaluation Report to the Amended PIA of Grab PH dated 15 August 2024 wherein the CMD found that “the revised PIA stipulates the conditions under which data retention is permissible under Grab PH’s Data Retention Policy. This policy specified that data related to safety incidents may be retained for a duration not exceeding ten (10) years, which balances the necessity of retaining data for security purposes with the right of individuals to data erasure.”134

In conclusion, the CMD found that “Grab PH has shown a proactive and compliant approach in addressing the directives of the Commission. The revised measures and included documentation substantiate their commitment to privacy, security and regulatory compliance. Therefore, it is determined that the revised PIA of Grab PH has substantially complied with the directives of the Commission.”135

With the submission of the CMD’s Compliance Evaluation Report, the revised PIA of Grab PH is compliant with the data privacy principle of proportionality.

Furthermore, the Commission holds that Grab PH complied with the principle of accuracy under the DPA, which provides:

SEC. 11. General Data Privacy Principles. – The processing of personal information shall be allowed, subject to compliance with the requirements of this Act and other laws allowing disclosure of information to the public and adherence to the principles of transparency, legitimate purpose and proportionality.

Personal information must, be:

…

(c) Accurate, relevant and, where necessary for purposes for which it is to be used the processing of personal information, kept up to date; inaccurate or incomplete data must be rectified, supplemented, destroyed or their further processing restricted[.]136

Based on its submissions, Grab PH manifested its compliance with the revision of the retention period and stated that “after 10 years, the selfie initially collected may no longer be accurate because of the changes in facial features of individuals as they age.”137 The Commission noted Grab PH’s conclusion that “the data will no longer be relevant to the purposes for which they were initially collected.”138

Considering the submissions and manifestations of Grab PH, the Commission notes that Grab PH “has put in place controls to immediately delete the selfie 10 years after collection, regardless of the user status, unless it is required by law to retain the data, such as when cases are filed in court.”139

In order to implement the principle of accuracy, Grab PH stated that prior the deletion of the selfie data:

Consumers’ selfie data are stored on AWS S3 servers located in Singapore (procured storage from Amazon AWS). Access to the AWS S3 bucket is restricted by default. Only the Grab Safety Engineering Team has ‘Read Only’ access (Users with Read Only access will be able to view the data only. Users cannot update/delete the data). Only the Grab Database Team has ‘Update Access’ to the AWS S3. AWS does not access or process Consumer selfie data.140

Grab PH also stated that the disposal of selfie data stored in AWS S3 is done by the Grab Database Team, upon request and approval of the Grab Safety Engineering Team.141

Therefore, the Commission finds that Grab PH outlined the data life cycle of its consumer verification selfie, demonstrating its compliance with the general privacy principles of the DPA.

On another note, by submitting its Revised PIA and manifesting its compliance to reduce the retention period to ten (10) years, Grab PH identified various privacy risks, such as lack of understanding of an individual on the purpose of collection and use of personal data; lack of understanding of the individual on how and where the personal data will be stored; data loss, unlawful access, misuse, alteration, or contamination of personal data; and other cybersecurity risks due to external or insider threats (including drivers and other service providers involved in data processing) that it needed to address, along with corresponding measures to sufficiently comply with the DPA.142

As to its organizational measures, Grab PH has data protection and security measure policies in place, to wit:

  1. AWS does not access or use Grab data as agreed under the AWS Enterprise Agreement.143

  2. Megvii has included access controls and kept Grab data physically and logically separate from other data and secured channels for accessing, transferring and storing Grab data.144

Grab PH confirmed that according to the Data Processing Agreement it has entered with Megvii, the latter “will ensure the reliability, integrity and trustworthiness of all its employees to whom it grants access to the Grab data” which includes “personnel policies and practices including written confidentiality agreements and background checks to ensure all employees who access, process or maintain Grab data are obliged to protect Grab data.”145

As to the implementation of physical security measures, in accordance with Grab PH’s agreement, Megvii “has physical and logical access controls, and has procedures for granting, reviewing, updating and revoking access to systems, data and facilities.”146 Grab PH has likewise “access control and user access management policy to review user accounts and their access rights.”147

According to Grab PH, “all access requests for system, services and application accounts and permissions are formally documented. Access to source code is critical and SSL (Secure Socket Layer) and MFA (Multi-Factor Authentication) are required for access.”148

With AWS, access policy is managed by Grab APEX and Grab PH’s Infosec team.149 AWS and Grab PH also agreed on the placing of barrier controls for the prevention of unauthorized entry to the facilities at the perimeter and at building access points.150 The AWS Enterprise Agreement also states that:

Facilities require either electronic access control validation (e.g., card access systems, etc.) or validation by human security personnel. All access points are maintained in a secured (locked) state. Access points to the facilities are monitored by video surveillance cameras designed to record all individuals accessing the Facilities.151

For the technical security measures, Megvii exhibited secured communication channels (such as HTTPS for data transfer between Grab and Megvii and AES256 for data encryption) in order to access and transfer Grab data.152 Grab PH likewise reported that its data are not read, copied, or changed by unauthorized persons when it is stored or transferred.153 Grab PH also confirmed that Megvii “has technical and organization controls such as information securities policies and procedure, human resource security, asset management, operation and communication security, information security incident management.”154

On the other hand, Grab PH stated that AWS is certified under ISO 27001 as a confirmation of the required level of protection.155

Grab PH stated that it has no written policy as to the verification or confirmation of requests from law enforcement authorities, nevertheless, it will validate the police requests by asking for police IDs and by calling the precinct that sent the request.156

Further, Grab PH has policies and procedures to restore the availability and access to personal data once a breach incident happens.157 Thus, Grab PH presented the following:

  1. Grab has an Incident Response Plan with policies and procedures for handling Incident Responses. As part of this process, during the Recovery Process, the Grab Engineering/SysOps experts restore Grab’s infrastructure and/or will work with relevant partners (Megvii, AWS, Incident response Team) to restore the selfie data.

  2. Megvii shall help to set up an incident response program to effectively respond to, remediate and mitigate the impact as agreed upon[.]

  3. As agreed with AWS in contract, AWS shall support incident response plans and also help to take correction actions needed.158

As to the encryption of personal data while in transit or at rest, Grab PH indicated that “[t]hey are stored in controlled environment where only authorized stakeholders i.e Grab safety engineering only … who have obtained the necessary clearances are able to access AWS S3 and process the selfies.”159

For cross-border data flows, while the selfie data is stored in AWS S3 server located in Singapore, the selfie data is also processed by Megvii who handles liveness detection and / or face matching.160 Grab PH stated that the data may likewise be accessed by its authorized employees providing user support or conducting safety investigations from outside of the Philippines such as its CE Teams, safety operations teams, and engineers from technical teams.161

Furthermore, Grab PH stated that the personal data can only be transferred outside of the Philippines if any of the following conditions are present:

a. The individual consents to the transfer

b. The organization reasonably believes that the recipient is subject to laws or a contract enforcing information handling principles substantially similar to the DPA.

c. The transfer is necessary for the performance of a contract between the individual and the organization

d. The transfer is necessary as part of a contract in the interest of the individual between the organization and a third-party

e. The transfer is for the benefit of the individual.162

Such transfer of data is made known to the application users on the entry page of the Passenger Selfie Verification screen, which according to Grab PH contains:

[I]nformation regarding transferring of personal data outside of Home Country (in this context, Philippines) is provided for, under Grab’s Privacy Policy, with the URL link to the said Privacy Policy is included therein. Grab ensures safeguards in place to adequate level of protection for the personal data of users.163

Finally, Grab PH stated that it has taken the following reasonable steps prior to any cross-border transfer of data:

  1. Performed the necessary due diligence by both the Privacy Office team and Vendor Security team whereby necessary approvals are obtained prior vendor onboarding.

  2. Signed Data Processing Addendum with the approved vendors (Megvii, AWS) with appropriate clauses governing, for example the collection, use, disclosure, retention, disposal, restriction on engagement of sub-processors without written approval from Grab.

  3. Calls between Grab, AWS and Megvii are conducted via HTTPS and data is stored in Grab database (Production storage in AWS S3 : prd-tis-safety, Test storage in AWS S3: stg-tis-safety). Only authorized stakeholders (as identified above under “Identifying Stakeholders”) who have obtained the necessary clearances are able to access and process the selfies.164

With the abovementioned measures, Grab PH has manifested their commitment to ensure that handling of selfies comply with the DPA.

Grab PH has implemented a safe storage of data in a controlled environment thereby ensuring that only authorized or licensed representatives have access thereto. Grab PH has shown its commitment to exercise due diligence by establishing their Privacy Office and Vendor Security teams and securing data processing agreements with third-party vendors.

Grab PH has also provided clear guidelines in allowing the transfer of personal data across borders. These include securing data subjects’ consent, making sure the recipient’s authority is aligned with the privacy principles under the DPA, or when they are necessary to fulfill a contract.

Lastly to ensure the security of personal data, all communications between Grab, AWS, and Megvii are conducted via HTTPS, and the data is stored securely in Grab’s production and test storage on AWS S3.

Therefore, with these procedures in place in their revised PIA, the Commission finds that Grab PH has shown that selfie data collected as well as other personal data will be processed lawfully, including the implementation of proper security measures in compliance with the DPA.

G. Grab PH has identified the risks, threats, and vulnerabilities to the processing of data subjects’ personal data, as well as the solutions to mitigate them.

Grab PH has identified the following risks, threats and vulnerabilities to have a low-risk rating:

  1. Consent of Data Subject
  2. Lack of understanding of an individual on the purpose of collection and use of personal data.
  3. Third-party risks (including drivers and other service providers involved in data processing).165

According to Grab PH, the abovementioned risks, threats and vulnerabilities have limited impact to the affected data subject as he or she may encounter significant inconveniences which may be overcome despite few difficulties, and that the probability of happening at some time is identified to be possible.166

Consequently, Grab PH recommended the following solutions:167

Recommended Solutions
Consent of Data Subject
Grab must ensure that it will not collect selfies of consumers unless the latter has given his/her consent. The consent form must be readily accessible and easily understandable to guarantee an informed consent.
Lack of understanding of an individual on the purpose of collection and use of personal data.
A statement briefly explaining the purpose of the data processing should be displayed prior to obtaining Consumer consent and before the passenger takes a selfie. The link to the Privacy Policy should also be easily accessible for transparency and for the Consumers’ reference at any point in time either before or after the data has been collected.
Grab should also provide other materials to help Consumers better understand the objectives behind the selfie verification flow. If possible, Grab can provide educational videos or online posts to further explain the process.
Third-party risks (including drivers and other service providers involved in data processing)
Grab must regularly conduct penetration testing and audit third party service providers. It must ensure that third party service providers have robust security measures.

Moreover, Grab PH determined as medium risk the “[l]ack of understanding of the individual on how and where the personal data will be stored.”168 While the impact is limited, the probability of the risk to occur was identified to be ‘likely’ or there is a strong possibility of such occurrence.169 As a recommended solution, Grab PH stated:

An explanation regarding this risk should be readily available to the Consumers. The link to the Privacy Policy should also be easily accessible for transparency and for the passengers’ reference at any point in time either before or after the data has been collected.

Grab should also provide other materials to help Consumers better understand how and where their data will be stored. If possible, Grab can provide videos or online posts to further explain the storage of data.170

Further, the “[d]ata loss, unlawful access, misuse, alteration, or contamination of personal data, and other cybersecurity risks due to external or insider threats” were also found by Grab PH to be medium risks, with a maximum impact to the data subjects as they may “encounter significant inconveniences, which they should be able to overcome but with serious difficulties.”171 As a recommended solution, Grab PH reported that it must conduct regular penetration testing and audit from third party service providers, as well as periodic updates of its software and security measures.172

Therefore, Grab PH recognized and addressed key risks raised by the Commission. Through Grab PH’s Revised PIA, they have taken active measures to address their deficiencies and has adequately modified their policies to comply with the general privacy principles of the DPA and its IRR.173

In view of the foregoing, by obtaining consent from data subjects, providing justified retention policies, and implementing stronger security measures, such as retaining data for a maximum of ten (10) years only in cases involving safety incidents and deleting consumer selfies upon request when accounts are deactivated, the Commission finds that Grab PH has justified its request for the lifting of the Cease-and-Desist Order dated 03 February 2020.174

WHEREFORE, premises considered, this Commission resolves to LIFT the CEASE-AND-DESIST ORDER issued on 03 February 2020 pertaining to the Roll-out of the Passenger Selfie Verification Project of Grab Philippines.

SO ORDERED.

City of Pasay, Philippines. 17 September 2024.

SGD

JOHN HENRY D. NAGA Privacy Commissioner

WE CONCUR:

SGD

LEANDRO ANGELO Y. AGUIRRE Deputy Privacy Commissioner

SGD

NERISSA N. DE JESUS Deputy Privacy Commissioner

Copy furnished:

DG Data Protection Officer Grab Philippines

OT Counsel for Grab Philippines

COMPLIANCE AND MONITORING DIVISION ENFORCEMENT DIVISION GENERAL RECORDS UNIT National Privacy Commission

Footnotes

  1. Urgent Motion to Lift Cease-and-Desist Order dated 04 June 2024 of Grab Philippines. ↩

  2. In Re: Grab Ph Selfie Verification and In-Vehicle Audio and Video Recording, NPC CC 20-001, Cease-and-Desist Order dated 04 February 2020. ↩

  3. Id. ↩

  4. Report/Compliance (to Notice of Deficiencies dated 31 January 2020 and Cease and Desist Order dated 3 February 2020) of Grab Philippines dated 18 February 2020, at p. 4. ↩

  5. Id. ↩

  6. NPC CC 20-001 (unreported), Resolution dated 19 November 2020 at p. 5. ↩

  7. Grab PH submitted its Compliance and Motion to Lift Cease-and-Desist Order dated 3 February 2020 of Grab Philippines dated 22 June 2021. ↩

  8. Motion to Resolve (Re: Compliance and Motion to Lift Cease-and-Desist Order dated 3 February 2020) dated 19 January 2022 of Grab Philippines, at p. 1. ↩

  9. Id., at p. 2. ↩

  10. NPC CC 20-001 (unreported), Resolution dated 03 February 2022. ↩

  11. Id. ↩

  12. Manifestation (Re: Resolution dated 03 February 2022) dated 03 March 2022 of Grab Philippines, at p. 1. ↩

  13. Id. ↩

  14. Id. ↩

  15. NPC CC 20-001 (unreported), Order dated 19 January 2023. ↩

  16. Id., at p. 2. ↩

  17. Privacy Impact Assessment for Consumer Verification via Selfie dated 06 February 2020 of Grab Philippines, at pp. 15-16. ↩

  18. Id., at p. 3. ↩

  19. Id. ↩

  20. Privacy Impact Assessment for Consumer Verification via Selfie dated 06 February 2020 of Grab Philippines, at p. 18. ↩

  21. Id., at pp. 18. ↩

  22. NPC CC 20-001 (unreported), Order dated 19 January 2023, at pp. 4-5. ↩

  23. Id. ↩

  24. Motion for Extension of Time to File Compliance dated 14 March 2023 of Grab Philippines. ↩

  25. NPC CC 20-001 (unreported), Order dated 30 March 2023, at p. 3. ↩

  26. Compliance with Motion to Lift Cease-and-Desist Order dated 05 April 2023 of Grab Philippines. ↩

  27. Id., referred to as Annex “C” ↩

  28. Id., at p. 2. ↩

  29. Id. ↩

  30. Compliance with Motion to Lift Cease-and-Desist Order dated 05 April 2023 of Grab Philippines, at p. 2. ↩

  31. Id., at p. 3. ↩

  32. Id. ↩

  33. Id. ↩

  34. Motion to Resolve dated 02 August 2023 of Grab Philippines, at pp. 2-3. ↩

  35. Id., at p. 7. ↩

  36. NPC CC 20-001 (unreported), Order dated 17 August 2023, at p. 4. ↩

  37. Id. ↩

  38. Motion for Reconsideration dated 18 December 2023 of Grab Philippines, at p. 2. ↩

  39. Id., at p. 4. ↩

  40. Id., at p. 5. ↩

  41. NPC CC 20-001 (unreported), Order dated 08 January 2024, at pp. 6-7. ↩

  42. Id., at p. 7. ↩

  43. Urgent Motion to Lift (Cease-and-Desist Order dated 3 February 2020) dated 04 June 2024. ↩

  44. Id., at pp. 2-5. ↩

  45. Id., at pp. 5-7. ↩

  46. Id., at pp. 7-8. ↩

  47. Urgent Motion to Lift (Cease-and-Desist Order dated 3 February 2020) dated 04 June 2024, at p. 4. ↩

  48. Id. ↩

  49. Id., at p. 5. ↩

  50. Id., at p. 1. ↩

  51. Urgent Motion to Lift (Cease-and-Desist Order dated 3 February 2020) dated 04 June 2024, at p. 1-2. ↩

  52. Id., referred to as Annex “C.” ↩

  53. Id., at p. 6. ↩

  54. Id. ↩

  55. Urgent Motion to Lift (Cease-and-Desist Order dated 3 February 2020) dated 04 June 2024, at p. 7. ↩

  56. Id. ↩

  57. Id. ↩

  58. Manifestation (to Order dated 8 January 2024) dated 20 August 2024 of Grab Philippines, at p. 1. ↩

  59. Id. ↩

  60. Id., at p. 2. ↩

  61. Id. ↩

  62. Manifestation (to Order dated 8 January 2024) dated 20 August 2024 of Grab Philippines, at pp. 3-4. ↩

  63. Id. ↩

  64. Id., at p. 4. ↩

  65. Id. ↩

  66. Manifestation (to Order dated 8 January 2024) dated 20 August 2024 of Grab Philippines, at p. 4. ↩

  67. Id. ↩

  68. Id., at p. 5. ↩

  69. Id. ↩

  70. Id. ↩

  71. Id. ↩

  72. An Act Protecting Individual Personal Information in Information and Communications Systems in the Government and the Private Sector, Creating for This Purpose a National Privacy Commission, and for Other Purposes Data Privacy Act of 2012, Republic Act No. 10173 (2012). ↩

  73. Id., chapter V § 20. ↩

  74. Id., chapter III § 11(d). ↩

  75. Id., § 11(e). ↩

  76. In Re: Grab Ph Selfie Verification and In-Vehicle Audio and Video Recording, NPC CC 20-001, Cease-and-Desist Order dated 04 February 2020, at p. 7. ↩

  77. Motion for Reconsideration dated 18 December 2023 of Grab Philippines, referred to as Annex B. ↩

  78. Id., referred to as Annex “B” at pp. 4-5. ↩

  79. Id., at p. 5. ↩

  80. Id. ↩

  81. Motion for Reconsideration dated 18 December 2023 of Grab Philippines, referred to as Annex “B,” at pp. 5-6. ↩

  82. Id., at p. 6. ↩

  83. Id. ↩

  84. Id. ↩

  85. Motion for Reconsideration dated 18 December 2023 of Grab Philippines, referred to as Annex “B” at p. 6. ↩

  86. Id., at p. 13. ↩

  87. Id., at p. 14. ↩

  88. Id. ↩

  89. Motion for Reconsideration dated 18 December 2023 of Grab Philippines, referred to as Annex “B” at p. 14. ↩

  90. Id. ↩

  91. Compliance with Motion to Lift Cease-and-Desist Order dated 05 April 2023 of Grab Philippines. ↩

  92. Id., referred to as Annex “C” ↩

  93. Id., at p. 2. ↩

  94. NPC CC 20-001 (unreported), Order dated 17 August 2023, at p. 4. ↩

  95. Id. ↩

  96. Manifestation (to Order dated 8 January 2024) dated 20 August 2024 of Grab Philippines, at p. 5. ↩

  97. Motion for Reconsideration dated 18 December 2023 of Grab Philippines, referred to as Annex “B” at p. 15. ↩

  98. Manifestation (to Order dated 8 January 2024) dated 20 August 2024 of Grab Philippines, at p. 4. ↩

  99. Data Privacy Act of 2012, chapter III, § 11. ↩

  100. National Privacy Commission, Implementing Rules and Regulations of the Data Privacy Act of 2012, rule IV, § 18(c) (2016). ↩

  101. Motion for Reconsideration dated 18 December 2023 of Grab Philippines, at p. 4. ↩

  102. Id., referred to as Annex “B” at p. 23. ↩

  103. Id., referred to as Annex “B” at p. 15. ↩

  104. Id., referred to as Annex “B” at p. 16. ↩

  105. Id., referred to as Annex “B” at p. 52. ↩

  106. Motion for Reconsideration dated 18 December 2023 of Grab Philippines, referred to as Annex “B” at p. 56. ↩

  107. Urgent Motion to Lift (Cease-and-Desist Order dated 3 February 2020) dated 04 June 2024, Annex C. ↩

  108. Id., at p. 6. ↩

  109. Motion for Reconsideration dated 18 December 2023 of Grab Philippines, referred to as Annex “B” at p. 18. ↩

  110. Id., at p. 19. ↩

  111. Id. ↩

  112. Id., at p. 19. ↩

  113. Id. ↩

  114. Id., at p. 19. ↩

  115. Id., referred to as Annex “B” at p. 20. ↩

  116. Id., referred to as Annex “B” at p. 20. ↩

  117. Id. ↩

  118. Motion for Reconsideration dated 18 December 2023 of Grab Philippines, referred to as Annex “B” at p. 20. ↩

  119. Id., referred to as Annex “B” at pp. 20-22. ↩

  120. Id., referred to as Annex “B” at pp. 22-23. ↩

  121. Id., referred to as Annex “B” at pp. 23-24. ↩

  122. Motion for Reconsideration dated 18 December 2023 of Grab Philippines, referred to as Annex “B” at pp. 29-42. ↩

  123. Id., referred to as Annex “B” at pp. 44-48. ↩

  124. Id., referred to as Annex “B,” at p. 13. ↩

  125. Urgent Motion to Lift (Cease-and-Desist Order dated 3 February 2020) dated 04 June 2024, Annex C. ↩

  126. Motion for Reconsideration (To the Order of this Honorable Commission dated 17 August 2023) dated 18 December 2023, Annex “B,” at p. 5. ↩

  127. Privacy Impact Assessment Consumer Verification via Selfie dated 06 February 2020 of Grab Philippines. ↩

  128. NPC CC 20-001 In re: Grab Philippines, Order dated 19 January 2023 of Grab Philippines. ↩

  129. Compliance and Monitoring Division (CMD), Revised Technical Report on Grab Philippines’ Consumer Verification via Selfie Project dated 17 May 20222. ↩

  130. NPC CC 20-001 In re: Grab Philippines, Order dated 19 January 2023 of Grab Philippines. ↩

  131. Motion for Reconsideration dated 18 December 2023 of Grab Philippines. ↩

  132. Motion to Resolve (To the Order of this Honorable Commission dated 17 August 2023) dated 18 December 2023, at p. 4. ↩

  133. Id., at pp. 4-5. ↩

  134. Compliance Evaluation Report to the Amended PIA dated 15 August 2024 of Grab PH, at p. 1. ↩

  135. Id., at pp. 1-2. ↩

  136. Data Privacy Act of 2012, chapter III, § 11(c). ↩

  137. Manifestation (to Order dated 8 January 2024) dated 20 August 2024 of Grab Philippines, at p. 5. ↩

  138. Id. ↩

  139. Id. ↩

  140. Urgent Motion to Lift (Cease-and-Desist Order dated 3 February 2020) dated 04 June 2024, referred to as Annex C, at p. 14. ↩

  141. Id., referred to as Annex C, at p. 18. ↩

  142. Motion for Reconsideration dated 18 December 2023 of Grab Philippines, referred to as Annex “B” at p. 51. ↩

  143. Id., referred to as Annex “B” at p. 34. ↩

  144. Id. ↩

  145. Id., referred to as Annex “B” at p. 35. ↩

  146. Motion for Reconsideration dated 18 December 2023 of Grab Philippines, referred to as Annex “B” at p. 36. ↩

  147. Id., referred to as Annex “B” at p. 37. ↩

  148. Id. ↩

  149. Id. ↩

  150. Motion for Reconsideration dated 18 December 2023 of Grab Philippines, referred to as Annex “B” at p. 37. ↩

  151. Id. ↩

  152. Id., referred to as Annex “B” at p. 39. ↩

  153. Id. ↩

  154. Motion for Reconsideration dated 18 December 2023 of Grab Philippines, referred to as Annex “B” at p. 39. ↩

  155. Id., referred to as Annex “B” at p. 40. ↩

  156. Id. ↩

  157. Id. ↩

  158. Motion for Reconsideration dated 18 December 2023 of Grab Philippines, referred to as Annex “B” at pp. 40-41. ↩

  159. Id., referred to as Annex “B” at p. 41. ↩

  160. Id., referred to as Annex “B” at p. 44. ↩

  161. Id. ↩

  162. Motion for Reconsideration dated 18 December 2023 of Grab Philippines, referred to as Annex “B” at p. 45. ↩

  163. Id. ↩

  164. Id., referred to as Annex “B” at pp. 47-48. ↩

  165. Id., referred to as Annex “B” at p. 49. ↩

  166. Motion for Reconsideration dated 18 December 2023 of Grab Philippines, referred to as Annex “B” at p. 50. ↩

  167. Id., referred to as Annex “B” at p. 51. ↩

  168. Id., referred to as Annex “B” at p. 49. ↩

  169. Id., referred to as Annex “B” at p. 50. ↩

  170. Motion for Reconsideration dated 18 December 2023 of Grab Philippines, referred to as Annex “B” at p. 51. ↩

  171. Id., referred to as Annex “B” at p. 50. ↩

  172. Motion for Reconsideration dated 18 December 2023 of Grab Philippines, referred to as Annex “B” at p. 51. ↩

  173. Id. ↩

  174. Urgent Motion to Lift (Cease-and-Desist Order dated 3 February 2020) dated 04 June 2024, at p. 4. ↩

Backlinks

  • No backlinks found