Editing Uber (section)

===Databreaches===
The [[Federal Trade Commission]] (FTC) filed a complaint for two alleged databreaches, of which Uber became aware in 2014 and 2016.<ref>https://www.ftc.gov/system/files/documents/cases/152_3054_c-4662_uber_technologies_revised_complaint.pdf</ref> As the complaint states in both databreaches, personal information was leaked:<blockquote>[2014] The intruder accessed one file that contained sensitive personal information belonging to Uber Drivers, including over 100,000 unencrypted names and driver’s license numbers, 215 unencrypted names and bank account and domestic routing numbers, and 84 unencrypted names and Social Security numbers. The file also contained other Uber Driver information, including physical addresses, email addresses, mobile device phone numbers, device IDs, and location information from trips the Uber Drivers provided.

[2016] The intruders downloaded 16 files from Respondent’s Amazon S3 Datastore between October 13, 2016 and November 15, 2016. These files contained unencrypted consumer personal information relating to U.S. Riders and Drivers, including, among other things, approximately 25.6 million names and email addresses, 22.1 million names and mobile phone numbers, and 607,000 names and driver’s license numbers. Nearly all of the exposed personal information was collected</blockquote>Uber failed to disclose the second larger breach to consumers or the FTC for more than a year, despite being the subject of an ongoing FTC investigation of its data security practices during that time.<ref name=":0">https://www.ftc.gov/news-events/news/press-releases/2018/10/federal-trade-commission-gives-final-approval-settlement-uber</ref> In 2018, the FTC approved a settlement with Uber regarding these incident.<ref name=":1">https://www.ftc.gov/system/files/documents/cases/152_3054_c-4662_uber_technologies_revised_decision_and_order.pdf</ref> 

*Uber could be subject to civil penalties if it fails to notify the FTC of certain future incidents involving unauthorized access to consumer information, which includes both driver and rider information.<ref name=":0" /><ref name=":1" />
*The company is also prohibited from misrepresenting how it monitors internal access to consumers’ personal information and the extent to which it protects the privacy, confidentiality, security, and integrity of personal information.<ref name=":0" /><ref name=":1" />
*Uber must implement a comprehensive privacy program and for 20 years obtain biennial independent, third-party assessments, which it must submit to the Commission, certifying that it has a privacy program in place that meets or exceeds the requirements of the FTC order.<ref name=":0" /><ref name=":1" />