Uber Settles With FTC Over Improper Access to Customer Information, Data Security Issues

Uber settled with the FTC over allegedly deceiving consumers by failing to oversee employee access to sensitive consumer data and reasonably securing such information stored in the cloud. Commissioners voted 2-0 Thursday to issue the administrative complaint and accept the consent agreement. Comments are due Sept. 15. Acting FTC Chairman Maureen Ohlhausen said in a conference call with reporters that the investigation began after media outlets in November 2014 reported that Uber employees accessed personal consumer data. The order requires the company to create "culture of privacy sensitivity," she said. Under the settlement, Uber must avoid misrepresenting how it internally monitors access to customers' personal data and how it protects their data. The company must implement a comprehensive privacy program addressing risks from current and new products and services and the confidentiality of the personal data collected. Within 180 days and every two years after that for the next 20 years, Uber must get independent, third-party audits certifying the privacy policy meets or exceeds the order's requirements. Ohlhausen said no financial penalty was imposed because the agency can get money only when it can point to financial losses. She said if Uber violates the order, the FTC can pursue a civil penalty. A spokesman said the company has "significantly strengthened our privacy and data security practices since [2015] and will continue to invest heavily in these programs." Uber hired its first chief security officer at the time and "now employ hundreds of trained professionals dedicated to protecting user information." Uber has been under FTC scrutiny in other cases. Consumer Watchdog in April lodged a complaint that the company deceptively tracked its app users after they deleted the app from their iPhones (see 1704270014). The FTC has said it doesn't comment on investigations. In January, the agency over allegations Uber misled prospective drivers about potential earnings and overstated favorable terms for car financing (see 1701200002).