New PDPA Advisory Guidelines on In-Vehicle Recordings by Transport Services for Hire

This update highlights some of the main points raised in the Guidelines.

Application of the PDPA to the use of in-vehicle cameras

The PDPC noted that in general, images, audio recordings, and video recordings of identifiable individuals captured in in-vehicle recordings would comprise personal data for the purposes of the PDPA for which consent would be required before any collection, use or disclosure is made. 

The PDPC makes a distinction between a camera facing into the vehicle (i.e. recording the passengers) and camera facing out of the vehicle (i.e. recording the road / traffic). In relation to outward-facing cameras, although the camera may be recording personal data, consent from the data subjects is not required as such data is likely to be "publicly available data" which is exempt from the notification and consent obligations under the PDPA.  However, that exemption does not apply for in-vehicle cameras as the interior of the vehicle would be considered to be a private space and, therefore, consent would be required.

Compliance with the notification and consent obligations

The Guidance states that: 

• Notices could be placed on the window of the passenger door or within the vehicle and recorded messages may be played in the vehicle before the start of the journey. 

An example given in the Guideline of a valid notice would be: 

"in-vehicle video and/or audio recording is in operation for security and safety purposes".

• It may be reasonable to require those who wish to use transport services to consent to the collection, use or disclosure of their personal data through in-vehicle recordings to ensure the safety and security of the drivers, or to deter fare evasion. 
• Consent is obtained if the individual continues to use the vehicle after seeing the notices. If the individual does not consent to the use of the in-vehicle camera, the individual has the option to decline their consent by refusing to use that vehicle.  

Since the Guidance was published, there has been concern voiced by the public that any consent given will not be free and fair; clearly if a majority of transportation companies mandate that all vehicles be fitted with in-vehicle cameras, it will be difficult for individuals to practically exercise their discretion to withhold consent since there may not be many vehicles available that do not conduct in-vehicle recordings. 

Additionally, the public was also concerned about the ability to make audio recordings of conversations and the level of protection that would be afforded to conversations that might be confidential, might contain trade secrets or market sensitive information or advice that may be subject to legal professional privilege.  

It is anticipated that the guidance, which is yet to be issued by the Land Transport Authority regarding the installation of any in-vehicle cameras, will address some of these issues. 

Withdrawal of consent

The Guidance also states that individuals are free to immediately withdraw their consent once they have reached their destination. Once the individual withdraws their consent, all further use and disclosure of the personal data must cease, unless there is an applicable exception. 

Transport companies will have to put in place measures that enable their drivers to record that consent has been withdrawn and privacy training would have to be conducted so that the drivers are aware of their obligations under the PDPA. 

However, notwithstanding the withdrawal of consent, the transport company does not need to delete or destroy such personal data and may retain it if it has a legal or business purpose. If this personal data is retained, the organisation will have to comply with a subject access request (discussed below).  

Subject access request

Transport companies are required to grant access to the personal data in their possession or control and provide information on how such information may have been used or disclosed by the organisation in the past year. In relation to in-vehicle recordings, individuals are entitled to request for a copy of the recording and these have to be provided by the transport companies.  

Interestingly, the Guidance provides an example of how a subject access request should not be made. In the example, an individual made a request to be provided with all recordings made in all taxis over the past year. The individual was unable to provide more specific information as to the particulars of the taxis / driver and dates on which the rides were taken. 

In this example, the Guidance stated that the transport company was justified in refusing the subject access request as it was unreasonable to require the transport company to go through all of the recordings of its entire fleet of taxis over the past year. 

The Guidance, however, does not state the level of specificity required in order for an individual to provide a valid subject access request. It could be a combination of any of the following: (1) taxi number; (2) name of driver; (3) date of trip; (4) location of pick up and drop of points; or (5) estimated time of pick up and drop off.  

It would be reasonable to assume that there would be an inverse relationship between the number of man-hours spent responding to the subject access request and the number of data points that the individual has provided. 

Additionally, as discussed above, since individuals are likely to have conversations in the vehicle (either in person or on the phone), transport companies have to be certain that when they respond to a subject access request, they only provide the individual (who is making the request) with his or her own personal data and not the personal data of any other individual. Again, this would involve the transport companies spending a not insignificant amount of time redacting audio and video files to ensure that the personal data of a third party is not disclosed without consent. 

Conclusion 

In car-light Singapore, taxis and private hire cars are widely used as the primary mode of transport. It is not surprising that the public reaction to this Guideline has been one of concern. We will keep you updated on any developments in this area.    

This article is produced by our Singapore office, Bird & Bird ATMD LLP, and does not constitute legal advice. It is intended to provide general information only. Please contact our lawyers if you have any specific queries.