Transport service providers get the green light to have inward-facing cameras as long as guidelines are followed: PDPC

Taxi and private-hire transportation drivers are allowed to continue using IVRDs only if they comply with the new advisory guidelines laid out.
The Straits Times

Drivers in the taxi and private-hire transportation business will be granted continued use of in-vehicle recording devices (IVRDs) as long as they abide by personal data protection guidelines, says the Personal Data Protection Commission of Singapore (PDPC).

Such drivers typically install such inward-facing video cameras in their vehicles to curb fare evaders and abusive passengers.

In an official statement released on Monday (Apr 9), PDPC said organisations that use IVRDs to capture personal data are required to comply with the Personal Data Protection Act (PDPA).

The image or voice of an individual that can be be used to identify him or her is classed as personal data, says PDPC, which is why IVRDs are subject to guidelines as specified in the Act.

According to the PDPA, transport organisations need to ensure that their drivers are aware of and exercise proper data protection practices.

Drivers are considered data intermediaries as they collect personal data using the devices on behalf of their organisations. They are therefore subject to the Protection and Retention Limitations Obligations of the PDPA.

What this means is that drivers will be responsible for ensuring that reasonable security arrangements are made to protect the data in their possession to prevent any form of data meddling.

They are also only allowed to retain in-vehicle recordings as long as there are legal or business-related reasons to do so.

PDPC added that when collecting personal data using IVRDs, organisations must:

  1. Notify individuals prior to boarding the vehicle of the purposes of collecting, using and disclosing their personal data captured by IVRDs;
  2. Ensure that personal data is used solely for reasonable purposes such as safeguarding the driver and passenger’s security or to deter fare evasion;
  3. Cease the use or disclosure of an individual’s personal data upon the withdrawal of consent by said person after using the transport service;
  4. Grant individuals access to the data in their possession and inform them about how it has been used in the past year, lest the burden or expense incurred is deemed unreasonable; and
  5. Make security arrangements to protect the personal data captured by IVRDs.

To help organisations and drivers understand the advisory guidelines, PDPC and the Land Transport Authority (LTA) have jointly produced and distributed hardcopy A5-sized handbooks through car rental and taxi companies and associations.

The handbooks illustrate common scenarios of transport services for hire and highlight key data protection obligations.