No migration of users’ data amid Uber-Grab acquisition
Assurance to LTFRB
Ride-hailing app Uber is set to go offline this Sunday as Grab takes over its operation, and as this happens, the government has extracted assurance from Grab that no unauthorized migration of users' data will take place.
On Thursday, the Philippine Competition Commission (PCC) had asked ride-sharing firms Uber and Grab to operate their respective platforms beyond April 8, pending its review of Grab's acquisition of Uber's operations in Southeast Asia.
"Unless PCC comes out with a decision, what we said 'on April 8, which is Uber would go offline', would still happen," Grab Philippines country head Brian Cu said in an interview on Friday.
He then said that with regards to acquisition, there is no acquisition of data among the users of Uber app.
"Even after April 8, no data will be shared. There is no path for us to take Uber’s data. The data we have received from Uber is only upon consent and that is only on the driver’s side. Drivers have to consent and say, I’m ok to share this data to assist in the on-boarding process to be able to drive on Grab. That is the only that has happened and will happen. We are business as usual when it comes to data and protecting that data," Cu said.
This was his answer to the call of National Privacy Commission (NPC) and the Land Transportation Franchising Regulatory Board (LTFRB) to be fully transparent as to what will happen with the personal data of around 1.2 million Filipino Uber account holders, and to ensure that these data are lawfully processed in the course of the acquisition.
"Transparency, choice, notice, security, redress mechanisms and other data privacy issues should be considered at all stages of the deal," NPC and LTFRB said in their joint statement released to the media on Friday.
When asked what sort of information Uber and Grab have of passengers apart from name and credit card, Cu said it's the users' phone numbers and email address.
Privacy Commissioner Raymund Liboro, for his part, assured that the NPC and LTFRB are jointly looking into the transaction details of the announced Grab-Uber acquisition.
"Since this acquisition potentially involves personal data, the NPC is keen on safeguarding data subjects' privacy in the process," Liboro said, citing a joint statement from NPC and LTFRB.
"Our intention is neither to hinder any legitimate business exchange, nor prevent the public from using the services of Gran, so long as personal data privacy is respected and protected," he added.
Based on the statement, he said the NPC is closely looking into this deal given consumer fears that the company's dominant market position might lead to possible abuses in how it processes personal data.
"Grab must implement appropriate organizational, physical and technical security measures, if the acquisition will involve any personal data processing. Mechanisms to accommodate the public's data privacy concerns relating to the deal should also be present," Liboro said.
"The NPC assures the public that it shall exercise its compliance and monitoring functions to check for any unauthorized processing during the acquisition, especially given that data subjects may have limited capacity to check themselves," he further said.