On August 15, the FTC announced that it had reached an agreement with Uber to settle allegations that the company had made deceptive claims about its privacy and data security practices. The FTC’s settlement with Uber has important implications for privacy and data security measures that companies could take, and the representations they and their employees make in these areas. It also shed greater light on what the FTC means by “reasonable data security” measures that companies should implement, and underscores the importance of maintaining a robust insider threat prevention program.
In 2014, Uber was the subject of news reports that alleged Uber employees could gain access to and use its customers’ personal information, including sensitive information such as their detailed trip records with precise geolocation. Uber responded to those media allegations with statements promising that Uber closely monitored and audited employees’ access to customer and driver information on an ongoing basis.
The FTC settlement with Uber emphasizes the growing importance of implementing an appropriate insider threat program. Among other things, such programs may include access and technical controls, monitoring, and data analysis and reporting. The FTC’s complaint against Uber alleged that, in contrast to the company’s promises, it did not regularly monitor or audit its employees’ access to customer and driver data. The FTC also alleged that Uber failed to follow up on timely alerts regarding the potential mishandling of customer personal information, and failed to provide reasonable security for its customers’ and employees’ personal information stored by Uber in a third-party cloud service.
According to the FTC’s complaint, Uber had stored “full and partial back-ups of Uber databases” in the cloud, which included driver and customer “names, nicknames, email addresses, postal addresses, phone numbers, unique device identifiers, trip records, geolocation information, and driver’s license numbers,” as well as driver “vehicle registration receipts, proof of insurance documents, and images of driver’s licenses.” Companies should ensure that they develop and implement programs to monitor access to sensitive employee, contractor and customer data, and that they follow-up on warning signs when employees or others transgress such access controls.
The settlement also sheds greater light on what the FTC means by “reasonable data security.” The FTC faulted Uber for engaging in a number of practices that, taken together, constituted an alleged failure to institute reasonable data security controls. The FTC’s action against Uber provides a roadmap of certain reasonable security measures that the agency may expect companies to have in place, by specifically alleging Uber failed to:
- restrict access rights by requiring programs and engineers with access to personal information to use distinct access keys (instead of allowing the use of a single key, which provided full administrative access rights and privileges to all data in the cloud);
- restrict access to data based on employees’ job functions (i.e., “need to know”);
- institute multi-factor authentication for access to the cloud storage;
- implement reasonable security training or a written information security plan; and,
- encrypt sensitive personal information stored in a centrally-accessible location (instead of storing the data in the cloud in clear, readable text, including in database back-ups).
The FTC paid particular attention to the potential for preventing or mitigating failures by implementing “relatively low cost measures” to reduce risk and protect consumer personal information stored in databases. The FTC’s recommended measures stress the importance of limiting access to data in accordance with employee roles and responsibility, multi-factor authentication, , and encryption of sensitive data, even when stored at-rest or in back-up tapes.
The FTC alleged that, as a result of the failure to institute these controls, an intruder was able to gain access to Uber’s sensitive personal information. The FTC faulted Uber for allegedly failing to detect the breach for 4 months and not notifying the affected Uber drivers (whose information was accessed) for an additional 5 months and, in some cases, almost two years after the breach was detected.
As part of the settlement, Uber agreed not to misrepresent the extent to which it monitors or audits its internal access to consumers’ personal information, or the extent to which it secures any personal information. The FTC order also mandates that Uber create and maintain a “comprehensive privacy program” reasonably designed to address privacy risks in the development and management of new and existing consumer products and services, and protect the privacy and confidentiality of personal information.
The program includes a risk assessment, “reasonable controls and procedures” to deal with reasonably foreseeable internal and external risks to personal information, controls on Uber’s service providers, and regular updates to the privacy program to address business changes or lack of program effectiveness. In addition, Uber agreed to submit third-party assessments of the program to the FTC after 180 days and thereafter every two years, and to report back to the FTC on its assessments over a period of 20 years.
According to FTC Acting Chairman Maureen K. Ohlhausen, “Uber failed consumers in two key ways: First by misrepresenting the extent to which it monitored its employees’ access to personal information about users and drivers, and second by misrepresenting that it took reasonable steps to secure that data. This case shows that, even if you’re a fast growing company, you can’t leave consumers behind: you must honor your privacy and security promises.”