Businesses struggle when partners expose customers' personal data

A dashcam clip recording the incident of musician Minh Khang arguing with a Grab driver in mid-March 2026 was posted by the driver and spread on social networks. Facial images, voices, and location data of passengers have been publicly disseminated. Grab responded by permanently blocking partner accounts, but this incident raises a key question for thousands of businesses: when partners and third parties disclose customer personal data, what should the business do to ensure compliance with the law as well as protect its reputation Customers' trust in the brand?

The data exposed in this case includes face, voice, and location data that are considered sensitive personal data by Vietnamese law.

Is the law as the public thinks

The incident began on March 11, 2026 when a clip recording the quarrel between Musician Minh Khang and the driver went viral online. On March 12, the musician officially reflected to Grab: the image, sound and location of him and his companion were revealed. Grab immediately identifies the driver's behavior as "collecting, using and disclosing personal information outside the scope of the service". After that, Grab asked the driver to stop violating but did not receive cooperation. By March 16, the company applied the Code of Conduct and privacy policy to permanently lock partner accounts, recommending customers to behave civilly[1].

The data exposed in this case includes face, voice, and location data that are considered sensitive personal data by Vietnamese law. This act not only violates the principle of limited collection for the right purpose, but also completely lacks the consent of the data subject. However, the majority of people are angry that businesses, specifically Grab, have supported the uncivilized behavior of passengers and "cut" the driver's business path. It seems that the incident has touched the usual way of thinking and doing that most people still think and have been doing for a long time.

However, Vietnamese law from the inception of Decree 13/2023/ND-CP to the Law on Personal Data Protection (Law on PDP) 2025 came into effect on January 1, 2026, forcing the processing of personal data (including collection and disclosure) into a strict legal framework.  in which the highest requirement is to obtain the consent of the data subject. In this case, Mr. Minh Khang is a passenger using Grab's services, the driver is a partner of Grab and provides services to customers on behalf of this unit. In the process of providing services, Grab is the Controller of customer data through the collection of customer information to provide transportation services; share part of the information (name, anonymous phone number, location) with the driver to make the ride. The Driver, in the course of performing the service under the agreement with Grab, acts as the Bad Handler. The driver's arbitrary extraction of the dash cam and posting it on social networks is an act of processing data beyond the scope of the Controller - Grab's instructions. In this case, the driver becomes an independent controller of such mishandling and is directly liable for his or her violation.

Without the customer's permission, as well as Grab's, the driver recorded and distributed them on social networks. The driver believes that the passenger's improper and disrespectful behavior is the basis for having the right to publicly post passenger information. Although the Law on PDP allows in some special cases the right to collect and disclose personal data without the consent of one person in order to protect the life, health and honor of the subject or of another person in urgent cases; to protect the interests of the State; to solve national security emergencies; or as required by law[2]. However, when comparing with these regulations, we think that it is difficult to confirm that the driver is in an urgent, urgent or legal situation to be able to publicize the personal image of the customer.

Grab's responsibilities

In the case, Grab VN was not the one who directly collected and posted passengers' personal data on social networks. But the driver - Grab's partner has carried out this act in the process of providing transportation services to Grab's customers on behalf of and on behalf of Grab. Therefore, although there is no violation in the processing of customer data, Grab is responsible for the actions of its partners as a transportation service provider for customers. Therefore, in this case, if the customer has a request and provides specific evidence, Grab must be civilly liable to compensate for damage to honor and reputation in accordance with the provisions of the Civil Code such as compensation for mental loss, economic damage and other remedial costs. This is a case where the company must compensate for damage caused by the company's people in the process of providing services. After Grab compensates for the damage, if considering the faulty behavior of the driver, it has the right to request a refund of this amount[3].

To handle the case, Grab chose to permanently lock the driver's account and affirmed strict compliance with the law on the protection of customers' personal data. At the same time, Grab emphasized that it does not tolerate the violation of the privacy of any partner (driver). However, the way to handle this case is correct but not enough. The wave of user criticism of Grab shows that Grab can do better instead of just "coldly" announcing the permanent locking of drivers' accounts who violate their regulations.

Because once the business model becomes increasingly dependent on partners and third parties, the risk of personal data disclosure is no longer an assumption but a risk of waiting at any time. 

Grab can do better

There have been similar cases in the world. Jason Gargac, 32, a part-time driver for Uber and Lyft in St. Louis, Missouri, installed a camera in his car and livestreamed about 700 rides since March 2018 on Twitch under the nickname JustSmurf without notice or consent from passengers. Uber and Lyft immediately and permanently suspended driver accounts for violating Community Guidelines. Although fortunately, the driver was not fined or had to bear other responsibilities. But the incident has sparked outrage in the U.S. over privacy, largely prompting Uber/Lyft to tighten its passenger video/livestream policy[4].

The two incidents are similar, but the two countries' responses are different. In addition to cultural differences, the legal system, the reaction of the responsible unit in this case also contributes to pushing the case in different directions.

In the case of Vietnam, businesses can completely come up with a better handling plan, both in terms of legal and empathy of a brand for customers, partners/employees.

First, Grab should publicize the process of handling the case. First, it is recommended to temporarily suspend the driver's activities and take steps to verify the case.

Secondly, organize a face-to-face working session with the participation of relevant people. In case, the relevant persons who do not participate can conduct an independent investigation of the case to collect and give directions to handle the case in accordance with the provisions of the law in a transparent and persuasive manner for the parties.

Third, consult the advisory team and give directions to handle the case based on the law and also consider other factors to come up with solutions that are not only legal but also "sympathetic". Avoid creating a sense of business bias, encourage customer misconduct instead of being an "arbiter", and minimize legal risks for all parties.

The right and appropriate handling not only helps to avoid controversy turning into a "brand crisis" event, but also turns the event into an opportunity to affirm the transparent and humane business philosophy of the business of respecting personal data and customer privacy in the face of the risks of the digital economy.

Compliance with the law is no longer an option

The above incident is a warning to businesses, especially technology and service companies in Vietnam about the risks of customer data leakage by third parties. Because once the business model becomes increasingly dependent on partners and third parties, the risk of personal data disclosure is no longer an assumption but a risk of waiting at any time. Vietnam's legal framework for personal data protection has been completed. The framework for sanctioning administrative violations is also being consulted for early promulgation and implementation in practice, which will be a big problem that businesses need to carefully consider in business activities in the coming time.

Businesses that take action today – updating contracts, regulations with third parties, clearly delineating responsibilities to each party as well as developing a plan to respond to data leaks and leaks will not only avoid billions of VND in fines but also enhance their brand.  increase customer trust and gain a sustainable competitive advantage. Because in the context of national digital transformation, PDP is not only a legal obligation but also a decisive factor for the "survival" of businesses.