Flashcards Studio

A Philippine ride-hailing platform, SwiftRide, collects riders’ personal data including name, phone number, home address, ride history, geolocation, and device identifiers. It contracts a private analytics vendor, AdverTech, to process data for targeted promotions and discloses data to AdverTech without informing the data subjects or obtaining consent. A rider, Ruben Santos, requests access to all personal data SwiftRide holds about him and asks that several inaccurate pickup locations in his ride history be corrected. SwiftRide responds by providing only a subset of the data and redacting certain fields, claiming some data are exempt from access and that sharing with the vendor is permissible under a “legitimate interests” basis. (a) Identify the data subject rights implicated by SwiftRide’s actions and the governing rule under RA 10173; (b) Explain whether SwiftRide’s disclosure and partial data provision comply with RA 10173, focusing on the requirement of consent or lawful basis for processing and the data subject’s access and correction rights; (c) If Ruben files a complaint with the National Privacy Commission, what remedies and penalties may be available and what evidence would support his claim.