27 April 2018
On 9 April 2018, the Personal Data Protection Commission (“PDPC”), in consultation with the Land Transport Authority (“LTA”), issued a set of advisory guidelines on how the Personal Data Protection Act 2012 (“PDPA”) applies when in-vehicle recording devices (“IVRDs”) are used by:
- organisations that lease vehicles to drivers who provide transport services for hire (“Leasing Companies”);
- drivers providing transport services for hire who lease vehicles from Leasing Companies (not employees of the Leasing Companies) (“Hirers”); and
- organisations providing transport services for hire, including drivers providing transport services for hire using their own vehicles (“Service Providers”).
Under the advisory guidelines, “transport services for hire” refer to transport services provided using vehicles such as taxis, private hire cars (e.g. limousine services including chauffeur-driven limousine services and GrabCar) and private charter buses.
In general, images, audio recordings and/or video recordings of identifiable individuals captured by IVRDs in transport vehicles for hire may contain personal data. For example, the image or voice of an individual that can identify him or her is considered personal data.
It is thus important that Leasing Companies, Hirers and Service Providers are clear as to their obligations under the PDPA, and put in place the necessary policies and practices to meet these obligations. The Leasing Company should ensure its Hirers are made aware of and exercise proper data protection practices when handling personal data captured in IVRDs, especially if the Hirer may be considered a data intermediary of the Leasing Company in respect of the in-vehicle recording where the Hirer records, stores or retrieves personal data in the in-vehicle recording on behalf of and for the purposes of the Leasing Company. Leasing Companies should clearly set out in contracts which are evidenced or made in writing the respective responsibilities and liabilities of the Leasing Company and the Hirers in relation to the personal data collected, used or disclosed in the course of providing the transport services, including whether the Hirer is to record, store or retrieve personal data in IVRDs on behalf of and for the purposes of the Leasing Company.
Generally, when collecting personal data via IVRDs, organisations must:
- Notify individuals of the purposes for collecting, using and disclosing their personal data captured by IVRDs. For example, a prominent notice may be placed at an appropriate location stating “in-vehicle video and/or audio recording is in operation for security and safety purposes”, or a recorded message may be played in the vehicle before the start of the journey to inform individuals that IVRDs are in operation.
- Ensure that they collect, use or disclose personal data only for purposes that are reasonable. Reasonableness of a purpose would depend on whether a reasonable person would consider it appropriate in the circumstances.
- Cease the use or disclosure of individuals’ personal data in the in-vehicle recording upon withdrawal of consent by the individual after using the transport service, unless the use or disclosure of the personal data without consent is required or authorised under the PDPA or any other written law.
- Grant individuals access to the personal data in their possession or control and provide information about how such personal data has, or may have been used or disclosed by the organisation in the past year, unless the burden or expense incurred for providing access would be unreasonable.
- Make reasonable security arrangements to protect the personal data captured by the IVRDs to prevent unauthorised access, collection, use, disclosure, copying, modification, disposal or similar risks.The PDPC and LTA have also jointly produced hard copies of an A5-sized handbook which illustrates common scenarios of transport services for hire and highlights key data protection obligations for organisations and drivers.
The following materials are available from the PDPC website www.pdpc.gov.sg: