Anvi Ahuja noticed a “freaky” new text message from a number she didn’t know right after getting back to her downtown Toronto apartment last month.
The text was a transcript of the conversation she’d just had with her roommates during their eight-minute Lyft ride home from a friend’s place.
“I was like ‘who is tapping me?'” Ahuja said. “The driver didn’t inform us that we could be recorded.”
Within a few minutes she called the number the text came from and heard this looping, automated message: “We can’t connect your call because your driver is not available right now.”
“It sounded like a pretty standard Lyft message, which raised a lot more questions,” she said.
Ahuja phoned Lyft that night looking for answers. In that initial call, she says a representative told her this was something the ride-sharing company was piloting. But then about a week later after following up with Lyft she received a written message from a member of the company’s safety team which blamed the incident on the driver for recording her without her consent and said “proper actions” were taken against the driver.
Ride-share recording incident leaves Toronto woman feeling ‘stalked’
“These ride-sharing apps are big companies and people have a lot of sensitive conversations within cabs and they feel like they’re secure,” said Ahuja.
“To know that nothing — even beyond our app experience — in the real world is secure anymore is really freaky and uncomfortable to me.”
The company confirms the incident took place, but has offered varying explanations.
After CBC Toronto contacted Lyft about this story last week, a Lyft representative called Ahuja. She says they told her the company is running a pilot program where audio is recorded from some rides and then the transcript is supposed to be sent to the ride-sharing company for reference if a security issue is reported.
In a statement to CBC, a Lyft spokesperson acknowledged that the ride-sharing company has an in-app audio recording pilot in select U.S. markets with “strict opt-in protocols” but said this incident is not related to that pilot program or any other feature being tested by Lyft.
“Safety is fundamental to Lyft, and we take reports like this very seriously and will investigate and take action for violations of our Terms of Service and Privacy Policy,” said the statement.
“We can confirm that the communication was sent via a masked number, and the driver did not have access to the rider’s personal phone number.”
Lyft’s privacy policy says it works “with a third party to facilitate phone calls and text messages between riders and drivers without sharing either party’s actual phone number with the other.” And the company’s recording device policy prohibits recording another person “without their express prior consent.”
The ride-sharing company wouldn’t provide further details about the source of the transcript Ahuja received, but it appears the text could have come from the driver via a masked number from Lyft’s third-party provider.
So how does Ahuja’s experience jive with Canadian privacy laws? A former privacy commissioner told CBC Toronto it doesn’t.
“It is completely unacceptable,” said Ann Cavoukian, who served as Ontario’s privacy commissioner from 1997 to 2014.
“You’re paying for a taxi-equivalent to take you somewhere, Lyft in this case. And of course, you assume that you’re going to have conversations with the people in the car without it being taped and transcribed.”
In Canada, the Personal Information Protection and Electronic Documents Act (PIPEDA) lays out the ground rules for how businesses — including companies like Lyft — can collect, use or share personal information.
The federal law requires companies to obtain informed consent before collecting, using and disclosing their customers’ personal information, according to the interim director of privacy, technology and surveillance program at the Canadian Civil Liberties Association.
“Passengers not only have to be notified that they’re being recorded, they also need to be told for what specific purpose they’re being recorded,” said Anaïs Bussières McNicoll.
“They would definitely need to obtain passengers’ meaningful consent, informed consent, and that includes being specific about how the data is going to be collected, how it’s going to be used, how long it’s going to be retained, how it’s going to be destroyed.”
That never happened for Ahuja, and is part of the reason she still has concerns about the incident even if it was a one-off with her driver.
“Some sort of recording software was used in the car — that in itself is a breach of my privacy,” she said.
“Even if I’m one of the very few people that experienced this, I’m still concerned about what happens to our data and our privacy — which is a responsibility that Lyft has to its customers.”
