Uber settles privacy complaint
FTC faults the company for ‘God View,’ data breach.
Uber has agreed to settle accusations by America’s top consumer protection agency that the ride-hailing company failed to protect consumers’ sensitive data, a misstep that allowed employees to access rider and driver information and led to a data breach in 2014 that exposed thousands of drivers’ names and license numbers.
The settlement with the Federal Trade Commission does not require Uber to pay to settle the allegations, the agency said Tuesday. The San Francisco company is required to hire an outside firm to audit its privacy practices every two years for the next two decades, and violations of the settlement could lead to financial penalties.
The agreement reflects Uber’s latest attempt to move past its troubled history and recent crises, which have been marked by Travis Kalanick’s resignation as chief executive, the departures of other top executives and an investigation into what some called a toxic workplace culture.
One source of the FTC’s concern was an Uber program known as God View, which enabled employees to monitor the real-time locations of customers who had requested a ride. The existence of God View caused an uproar in 2014, and Uber soon released a statement to say it maintained a “strict policy” that prevented employees from inappropriately spying on customers.
But the FTC said in its complaint that Uber misled the public about its efforts to stop any snooping. Despite building an automated system to police employees’ access to God View, Uber abandoned the tool after less than a year and “rarely monitored” how employees were subsequently using God View, according to the FTC. The agency’s investigation began shortly after news reports emerged about God View, but it does not cover later privacy-related revelations about tools such as Greyball, which Uber has used in some cases to track and circumvent regulators.
The FTC also said Uber failed to implement basic security practices, such as two-factor authentication, that could have kept driver data from leaking. Uber also stored customer information, including location data, in an unencrypted format online, the agency said.
Uber said that the allegations date to 2014 and that before the government complaint, it had already put safeguards in place to protect data. Since then, it said, it has strengthened privacy and data security and will keep investing in security.
“This settlement provides an opportunity to work with the FTC to further verify that our programs protect user privacy and personal information,” Uber said in a statement.
Acting FTC Chairwoman Maureen Ohlhausen said the settlement will force Uber to “take privacy into account every day.”
“Companies will be held accountable for their promises,” Ohlhausen said. “This is the only way we can foster true competition on privacy practices in the marketplace.”
The FTC voted 2 to 0 to accept the agreement. The public will be able to comment for 30 days, after which a final decision will be made.
Fung writes for the Washington Post. The Associated Press was used in compiling this report.