Personal Data Protection Commission issues advisory guidelines on in-vehicle recording
Today, it is common practice for transport services for hire such as taxi services, private hire car services, and private charter bus services, to deploy In-Vehicle Recording Devices (IVRDs). However, images, audio recordings and/or video recordings of identifiable individuals captured by IVRDs in transport vehicles for hire may contain personal data. For example if the image or voice of an individual is considered personal data as it can be used to identify him or her.
To provide organisations with greater clarity on specific requirements and obligations under the Personal Data Protection Act (PDPA), the Personal Data Protection Commission (PDPC) has published a set of advisory guidelines, which were developed in consultation with the Land Transport Authority (LTA).
The guidelines also take into consideration feedback from taxi and car rental companies, the National Private Hire Vehicles’ Association, the National Taxi Association and the Vehicle Rental Association through a series of closed-door consultation sessions.
According to the latest advisory guidelines issued by PDPC, organisations that use IVRDs to capture personal data are required to comply with provisions under the PDPA. As such, organisations must put in place the necessary policies and practices to meet these obligations. For example, organisations that lease vehicles to drivers to provide transport services for hire should also ensure that drivers, as data intermediaries, are aware of and exercise proper data practices and security arrangements involving the collection, use and disclosure of personal data captured by IVRDs.
Key requirements of the advisory guidelines by PDPC
When collecting personal data via IVRDs, organisations must:
(1) Notify individuals of the purposes for collecting, using and disclosing their personal data captured by IVRDs
For example, a prominent notice should be placed on the passenger door and/or in the vehicle such that individuals are made aware, prior to boarding the vehicle, that IVRDs are deployed in the vehicle and the purpose of deployment
(2) Ensure that the collection, use or disclosure of personal data are only for purposes that are reasonable, such as to ensure the safety and security of the driver and the passengers or to deter fare evasion
(3) Cease the use or disclosure of individuals’ personal data in the in-vehicle recording upon withdrawal of consent by the individual after using the transport service, although they need not delete the recording upon withdrawal of consent, and may retain it if there are any legal or business purposes
(4) Grant individuals access to the personal data in their possession or control and provide information about how such personal data has, or may have been used or disclosed by the organisation in the past year, unless the burden or expense incurred for providing access would be unreasonable
(5) Make reasonable security arrangements to protect the personal data captured by the IVRDs to prevent unauthorised access, collection, use, disclosure, copying, modification, disposal or similar risks
To raise public awareness on the latest advisory guidelines and personal data protection, PDPC and LTA have jointly produced an accompanying handbook that illustrates common scenarios of transport services for hire and highlights key data protection obligations for organisations and drivers.
Hardcopies of the handbook have been distributed to drivers through the car rental companies, taxi companies and associations.