Grab fined S$10,000 for compromising the data of more than 21,000 individuals

Singapore

SINGAPORE'S privacy watchdog, in a decision paper made public on Thursday, disclosed that it fined ride-hailing firm GrabCar S$10,000 in July this year, after a 2019 update to its mobile app put the data of 21,541 drivers and passengers at risk of unauthorised access.

Yeong Zee Kin, deputy commissioner for personal data protection at the Personal Data Protection Commission (PDPC), said that Grab, in failing to have robust processes to manage changes to its IT system that could put personal data at risk, committed a "grave error". He noted that it was the second time Grab was making a mistake of this kind, and the fourth time it was breaching a particular section of the Personal Data Protection Act (PDPA).