Singapore's PDPC investigating allegations that Muslim Pro developer sold user data to US military

Singapore

BITSMEDIA, the Singapore-based developer of the religious app Muslim Pro, is under investigation by the Republic's Personal Data Protection Commission (PDPC) after allegations that the company sold its users' personal data to the US military.

In response to queries from The Business Times, a PDPC spokesperson said the commission is requesting more detailed information from Bitsmedia. PDPC reminded users to be mindful of the type of permissions and personal data that they provide, and how it may be used.

In a statement on its website, Bitsmedia denied the allegations - which first surfaced in US news outlet Vice - and said it has launched an internal investigation into the matter.

Vice reported on Monday that the US military is buying "granular movement data" of individuals globally.

The report said user data from Muslim Pro, an app that features Muslim religious texts and prayer schedules, was sold to X-mode, a US-based data broker whose customers allegedly include US military defence contractors.

Such data included location details, names of WiFi networks linked to the phone, timestamps and information about the user's phone such as its model, according to Vice's report.

Bitsmedia said in its statement on Tuesday evening that it has terminated its relationships with all data partners, including X-Mode. The company added that its users' data is secure and apologised to users for the concern that media reports have caused them.

In another statement on Friday, it said that it has never provided any third party with non-anonymous data. It said that X-Mode Social, Inc confirmed on Tuesday that it had stopped working with both Sierra Nevada Corporation and Systems & Technology Research - the companies Vice described as US military contractors - long before Muslim Pro enrolled X-Mode Social as a data partner.

"Muslim Pro has been subject to a shameless and blatant perversion of the truth that has created an unprecedented emotion in our community of users," the company said.

When checked by BT on Tuesday evening, Muslim Pro's online privacy policy did not cite X-Mode, but stated that Bitsmedia works with location-data firm Quadrant "to collect and share precise location information", and that other data points include device type and IP address. On its website as of Tuesday evening, Quadrant listed X-Mode as a "trusted partner".

In an update on Thursday, Quadrant said its "trusted partners" page is not a list of its current clients, but based on the list of companies conforming to the Interactive Advertising Bureau's Transparency & Consent Framework. X-Mode was no longer listed on the page.

Quadrant said it never knowingly obtains, stores, or sells location data that is not compliant with data protection laws. "If we learn that we've acquired such data through external suppliers, we delete them in line with regulations," it said.

Organisations with mobile apps available to Singapore users must comply with the data protection requirements of the Personal Data Protection Act (PDPA).

With the passing of amendments to the PDPA in Parliament this month, the maximum financial penalty for breaching the Act will be increased to either 10 per cent of an organisation's annual turnover in Singapore or S$1 million, whichever is higher. The current cap is S$1 million.

- Additional reporting by Sharanya Pillai