18 April, 2018
On 9 April 2018, the Personal Data Protection Commission ("PDPC") released a new guidance note ("Guidance") on the application of the Personal Data Protection Act 2012 ("PDPA") when in-vehicle cameras are used by transport services for hire such as taxi services, private hire car services and private charter bus services.
This update highlights some of the main points raised in the Guidelines.
Application of the PDPA to the use of in-vehicle cameras
The PDPC noted that in general, images, audio recordings, and video recordings of identifiable individuals captured in in-vehicle recordings would comprise personal data for the purposes of the PDPA for which consent would be required before any collection, use or disclosure is made.
The PDPC makes a distinction between a camera facing into the vehicle (i.e. recording the passengers) and camera facing out of the vehicle (i.e. recording the road / traffic). In relation to outward-facing cameras, although the camera may be recording personal data, consent from the data subjects is not required as such data is likely to be "publicly available data" which is exempt from the notification and consent obligations under the PDPA. However, that exemption does not apply for in-vehicle cameras as the interior of the vehicle would be considered to be a private space and, therefore, consent would be required.
Compliance with the notification and consent obligations
The Guidance states that:
Notices could be placed on the window of the passenger door or within the vehicle and recorded messages may be played in the vehicle before the start of the journey.
An example given in the Guideline of a valid notice would be:
"in-vehicle video and/or audio recording is in operation for security and safety purposes".
It may be reasonable to require those who wish to use transport services to consent to the collection, use or disclosure of their personal data through in-vehicle recordings to ensure the safety and security of the drivers, or to deter fare evasion.
Consent is obtained if the individual continues to use the vehicle after seeing the notices. If the individual does not consent to the use of the in-vehicle camera, the individual has the option to decline their consent by refusing to use that vehicle.
Since the Guidance was published, there has been concern voiced by the public that any consent given will not be free and fair; clearly if a majority of transportation companies mandate that all vehicles be fitted with in-vehicle cameras, it will be difficult for individuals to practically exercise their discretion to withhold consent since there may not be many vehicles available that do not conduct in-vehicle recordings.
Additionally, the public was also concerned about the ability to make audio recordings of conversations and the level of protection that would be afforded to conversations that might be confidential, might contain trade secrets or market sensitive information or advice that may be subject to legal professional privilege.
It is anticipated that the guidance, which is yet to be issued by the Land Transport Authority regarding the installation of any in-vehicle cameras, will address some of these issues.
Withdrawal of consent
The Guidance also states that individuals are free to immediately withdraw their consent once they have reached their destination. Once the individual withdraws their consent, all further use and disclosure of the personal data must cease, unless there is an applicable exception.
Transport companies will have to put in place measures that enable their drivers to record that consent has been withdrawn and privacy training would have to be conducted so that the drivers are aware of their obligations under the PDPA.
However, notwithstanding the withdrawal of consent, the transport company does not need to delete or destroy such personal data and may retain it if it has a legal or business purpose. If this personal data is retained, the organisation will have to comply with a subject access request (discussed below).
Subject access request
Transport companies are required to grant access to the personal data in their possession or control and provide information on how such information may have been used or disclosed by the organisation in the past year. In relation to in-vehicle recordings, individuals are entitled to request for a copy of the recording and these have to be provided by the transport companies.
Interestingly, the Guidance provides an example of how a subject access request should not be made. In the example, an individual made a request to be provided with all recordings made in all taxis over the past year. The individual was unable to provide more specific information as to the particulars of the taxis / driver and dates on which the rides were taken.
In this example, the Guidance stated that the transport company was justified in refusing the subject access request as it was unreasonable to require the transport company to go through all of the recordings of its entire fleet of taxis over the past year.
The Guidance, however, does not state the level of specificity required in order for an individual to provide a valid subject access request. It could be a combination of any of the following: (1) taxi number; (2) name of driver; (3) date of trip; (4) location of pick up and drop of points; or (5) estimated time of pick up and drop off.
It would be reasonable to assume that there would be an inverse relationship between the number of man-hours spent responding to the subject access request and the number of data points that the individual has provided.
Additionally, as discussed above, since individuals are likely to have conversations in the vehicle (either in person or on the phone), transport companies have to be certain that when they respond to a subject access request, they only provide the individual (who is making the request) with his or her own personal data and not the personal data of any other individual. Again, this would involve the transport companies spending a not insignificant amount of time redacting audio and video files to ensure that the personal data of a third party is not disclosed without consent.
Conclusion
In car-light Singapore, taxis and private hire cars are widely used as the primary mode of transport. It is not surprising that the public reaction to this Guideline has been one of concern. We will keep you updated on any developments in this area.
For further information, please contact:act:
Daniel Song, ATMD Bird & Bird
daniel.song@twobirds.com
