Uber and the Federal Trade Commission (FTC) have settled a complain the company’s privacy and security practices. The settlement will require Uber to implement a new privacy program and submit itself to regular third-party audits to make sure it’s protecting its users’ data.
The complaint in question alleged that Uber misrepresented its privacy and security programs to riders and drivers. The FTC said Uber failed to stop employees from inappropriately accessing user data, and that the company failed to provide “reasonable security” for the data it stored on Amazon Web Services.
The commission said in a news release that, as a result of this settlement, Uber will be:
- prohibited from misrepresenting how it monitors internal access to consumers’ personal information;
- prohibited from misrepresenting how it protects and secures that data;
- required to implement a comprehensive privacy program that addresses privacy risks related to new and existing products and services and protects the privacy and confidentiality of personal information collected by the company; and
- required to obtain within 180 days, and every two years after that for the next 20 years, independent, third-party audits certifying that it has a privacy program in place that meets or exceeds the requirements of the FTC order.
You can find the full agreement between Uber and the FTC here (PDF). The public has 30 days to comment on the agreement before it’s finalized, so if you think there’s something missing, you can let the FTC know any time between now and September 15.
