Philippines’ privacy watchdog summons Grab after deal with Uber

MANILA, Philippines – The National Privacy Commission (NPC) called for a meeting with Grab Philippines next week to discuss how its merger with Uber would affect Filipino drivers’ and users’ data.

This comes after Uber on Monday, March 26, announced that it sold its operations in Southeast Asia to Grab. In turn, Uber will receive a 27.5% stake in the business. 

Uber drivers in the Philippines on Monday started receiving emails from the transport network company, asking them to transition to the Grab platform by April 8.

“We have called Grab to a meeting next week to enlighten the commission on this ‘sale,’ particularly its provision on the processing of Filipino drivers’ and users’ data and the measures they take in protecting these data,” NPC Commissioner Raymund Liboro said in a statement on Tuesday, March 27.

“As the biggest transport network vehicle provider in the Philippines after the exit of Uber, we want Grab to demonstrate that they could ‘walk the talk’ when it comes to protecting personal data and upholding the data privacy rights of its drivers and users.” (READ: As Uber gives up Philippine operations to Grab, what now for commuters?)

Liboro added that Grab, through lawyer John Paul Nabua, assured the privacy watchdog of its continued cooperation and compliance with Philippine data privacy and protection laws.

“Grab also declared to the commission that there will be no sharing of any user data between Uber and Grab. Uber users and drivers will be required to register anew with Grab to allow them to use the Grab TNV platform,” Nabua said.

No impact on data breach probe

The NPC on Tuesday said Uber’s merger with Grab would not affect the agency’s ongoing probe into a data breach in 2017, which exposed information on drivers and users of Uber.

“This sale does not affect our ongoing investigation into past Uber breaches that involved Filipino users,” Liboro said.

“This investigation is continuing and a report would be out soon,” he added.

Back in November 2017, the chief executive officer of California-based Uber, Dara Khosrowshahi, announced the firm failed to disclose a massive breach that exposed information on over 57 million users of the application.

Uber had said that two individuals downloaded data from a cloud server used by the ride-sharing application, containing names, email addresses, and contact numbers of users.

Meanwhile, Philippine Competition Commission (PCC) Chairman Arsenio Balisacan said on Monday that no notification has been filed at the agency by Grab or Uber to date. (READ: Uber drivers in Southeast Asia moving to Grab in 2 weeks)

“If the parties meet the new threshold, they should notify the PCC within 30 days after signing of their definitive agreement,” Balisacan said.

Earlier this month, the PCC doubled the threshold for reviewing merger and acquisition (M&A) transactions in the country.

The PCC raised the threshold to P5 billion for the value of assets or revenues of the parent entity, and P2 billion for the size of the transaction as defined in the implementing rules and regulations. – Rappler.com