Grab users raise privacy concerns over default audio recording feature

Some users of ride-hailing app Grab were caught off-guard when they realised an audio recording safety feature was switched on by default, saying they did not recall receiving a notification about it.

But Grab told The Straits Times on Feb 11 that it had informed users about the new arrangement, under which AudioProtect, the app’s voice recording feature, would be turned on by default.

The company said users should have received in-app messages and push notifications for one month after booking the first ride with the feature activated.

AudioProtect acts as a safety measure for users and drivers during a ride, as these recordings can be used to resolve issues arising from safety incidents more efficiently.

From Oct 2023, a microphone logo would appear in-app during each ride while the feature is enabled.

This is part of the second stage of a trial conducted by Grab with approval from the Land Transport Authority (LTA), which started on Nov 29, 2024 and will end by May 28.

In the first stage of the trial that ran from March 20 to Sept 20, 2023, AudioProtect was offered to users on an opt-in basis, where they had to consent to it via an in-app pop-up to activate it.

According to Grab, the first phase of the trial saw nearly 70 per cent of its users reporting an increased sense of security during rides with AudioProtect enabled.

It said AudioProtect was offered on an opt-in basis during the first stage, as the feature was new and users needed “ample time to familiarise themselves” with it.

In the second stage, the feature is enabled by default for all users. Grab said this opt-out arrangement will make the feature more widely available, and allow more users to benefit from its enhanced safety.

An ST reader, a data protection specialist in her 30s who requested anonymity for privacy reasons, told ST she had contacted the Personal Data Protection Commission (PDPC) – the country’s data privacy watchdog – in January because she was concerned about the automatic activation of AudioProtect.

Nine out of the 10 Grab users ST spoke to said they did not recall receiving notifications. Eight of them were uncomfortable and displeased with this arrangement.

The ST reader said she felt that switching AudioProtect on by default is “inappropriate” because many people make private phone calls to doctors, banks or family members during rides, and they might reveal sensitive data such as medical conditions or financial transaction details.

Adding that she did not recall seeing notifications about Grab’s switch to an opt-out arrangement in the second phase of the trial, the reader said the microphone icon, which indicates that AudioProtect is switched on, is “a tiny icon” that the average user would be unlikely to notice.

Ms Kelly-Ann Semper, a lawyer in her 30s, agreed, adding that these push notifications and the microphone icon “assume a high level of attention and tech savvyness” on the part of Grab users.

The British national, who has been in Singapore for 12 years, said she has never noticed the microphone icon, and that she was “quite outraged” by the “invasive feature” since she did not have a say before it was turned on.

Similarly, finance manager Kylie Tay, 32, said she would prefer to have a pop-up notification asking for her consent. She was not comfortable with being recorded, and opted out the moment she found out about the feature.

However, Mr Jordan Neo, 33, was fine with AudioProtect being activated by default, adding that it was a good idea to ensure the safety of riders and drivers.

The strategy and product lead said he was “not surprised” by the opt-out arrangement since it leads to the highest participation rate.

LTA said it approved this new arrangement on two conditions.

First, Grab must inform users that the feature is enabled by default in all subsequent uses of the app after the first time they book a ride with AudioProtect enabled.

Then, the company must inform passengers on every ride where AudioProtect is activated.

In response to user feedback, Grab has started since Feb 3 to notify users with in-app messages and push notifications at every ride that AudioProtect is switched on.

This was previously done on a weekly basis for just one month.

Grab also said that in the week leading to Nov 29, 2024, a banner informing users of the new opt-out arrangement for AudioProtect was featured on its app homepage.

The ride-hailing platform said all audio recordings are encrypted and securely stored in the user’s device.

It added that no one can access the recordings unless a safety report is lodged by the passenger or driver, and these recordings are permanently deleted if no report is made within five days.

Lawyers told ST that organisations are technically allowed to collect data without obtaining express consent from users, as long as they fulfil certain legal obligations.

Mr Ronald Wong, deputy managing director of law firm Covenant Chambers, who specialises in technology and intellectual property, said users can be deemed to have given consent by notification unless they notify the organisation of their refusal within a certain period.

According to Section 15A of the Personal Data Protection Act (PDPA), the organisation has to assess and eliminate, mitigate or reduce the likelihood of adverse effects that users may face from the collection, use or disclosure of data, in addition to giving users sufficient notice of information and reasonable time to opt out.

Adding that meeting these conditions could differ on a case-by-case basis, Mr Wong said an organisation has to be mindful that its customers are sufficiently informed so that it can maintain their trust, even if it is entitled by law to proceed based on deemed consent.

Mr Lim Chong Kin, head of data protection, privacy and cyber security at law firm Drew and Napier, said that generally, where an organisation’s intended purposes are related to security and safety, it would typically be appropriate to rely on the exception to consent for “legitimate interests” under the PDPA.

To rely on this exception, organisations should be able to identify and substantiate the “legitimate interests” arising from the collection, use or disclosure of data. Some examples of these “legitimate interests” include detecting or preventing illegal activities or threats to physical safety and security, and the prevention of misuse of services.

Mr Lim added that the PDPA does not stipulate the form or manner that qualifies as adequate notification, although the PDPC has several guidelines.

An organisation should determine the “best way” to notify users, such that they are provided with the necessary information to understand why and how their personal data is collected, used or disclosed. 

It also states that an organisation should consider informing users via the most appropriate communication channel and drafting notices that are easy to understand.

Uber and Chinese platform Didi Chuxing also have audio-recording features for safety.

Having introduced the audio recording feature in more than a dozen countries in Africa, Asia, North America and South America from 2023, Uber allows its users to switch this function on when they feel uncomfortable or unsafe during a ride.

An Uber user will receive a notification stating that the ride may be recorded – if the driver has switched the feature on – and he or she will have the option to cancel the ride before it arrives.

Launched in 2018, the compulsory safety function on Didi requires all passengers and drivers to consent to having their voices recorded during their rides. If they do not agree, they will be unable to take a ride using the platform.

Source: The Straits Times © SPH Media Limited. Permission required for reproduction.

The perks and pitfalls of young couples going solo for a BTO flat New payments entity, automated verification tool to boost Singapore’s status as finance hub