Regulators criticized company’s cover-up of data breach

After a data breach exposed information about 57 million user accounts and Uber covered it up (including paying hackers a ransom), multiple regulators criticized Uber’s response.

The FTC said it was “closely evaluating the serious issues raised.”

The New York Attorney’s General office said it opened an investigation of Uber’s actions. The Massachusetts Attorney General reported “serious concerns” about Uber’s conduct. Attorneys general in New York, Illinois, and Connecticut also opened investigations, as did the city of Portland, Oregon.

The UK Information Commissioner’s Office pointed out that “Deliberately concealing breaches from regulators and citizens could attract higher fines.” Current British law imposes penalties up to 500,000 pounds for failing to notify users and regulators about data breaches. More than 2.7 million UK users were affected.

Mexico’s National Institute of Transparency, Access to Information and Protection of Personal Data also criticized the breach and Uber’s response, seeking information about effects on Mexican citizens.

In addition, Uber faced three class action lawsuits alleging that it was negligent in its failure to protect consumer data.

Possible bribery in China, India, Indonesia, Malaysia and South Korea

Uber’s attorneys are investigating the possibility of improper payments in Asia, including what Bloomberg calls “suspicious activity” in China, India, Indonesia, Malaysia and South Korea.

In one incident in Jakarta, Indonesia, an Uber employee is said to have “decided to dole out multiple, small payments to police in order to continue operating there.” The company’s head of Indonesia approved the expense report — and was later placed on leave and left the company.

In another instance, Uber contributed tens of thousands of dollars to the Malaysian Global Innovation and Creativity Centre, a government-backed entrepreneur hub. Soon thereafter, the Malaysian government passed laws favorable to Uber. Lawyers are assessing whether this was a quid-pro-quo or otherwise improper.

Legal department “spirit of rule-breaking”

Bloomberg reported that then-CEO Travis Kalanick encouraged then-General Counsel Salle Yoo to create a legal department with what Bloomberg called a “spirit of rule-breaking.” In a performance review, Kalanick told Yoo she needed to be more “innovative.” Bloomberg reports that Yoo considered herself “liberated” by not having to follow “best practices,” being allowed “to do things the way I think things should be done, rather than the way other people do it.” But Bloomberg says Yoo failed to challenge Kalanick and his deputies, or raise objections to Uber’s board.

At least five criminal probes by US Justice Department

In October 2017, Bloomberg reported at least five criminal probes of Uber by the US Department of Justice, two more than previously reported. Additions:

  • violations of price-transparency laws
  • Uber’s role in the alleged theft of schematics and other documents related to Google autonomous-driving technology

London Employment Tribunal determined that Uber unlawfully denied basic workers’ rights

Having determined that Uber drivers are employees, the London Employment Tribunal further determined that Uber unlawfully denied drivers certain basic rights guaranteed to all employees.

Among other rights, GMB alleged that Uber drivers were entitled to holiday pay, a guaranteed minimum wage, and breaks.

GMB specifically challenged the amount that drivers are paid. After deducting costs and fees, GMB found that members could make as little as 5 GBP per hour, well below the national minimum wage of 7.20 GBP. They also challenged Uber’s practice of deducting sums from drivers’ pay including in response to customer complaints.

LET also found that, contrary to Uber’s insistence that Netherlands law governs the relationship between Uber and its London drivers, in fact British law governs because the relationship “relevant to the situation” was the UK.

Uber appealed the decision. A judgment of the appeal is expected in late 2017.

Portland “Regulation Evasion Audit” of Uber Greyball

In response to Uber’s Greyball blocking of government investigations, the Portland Bureau of Transportation (PBOT) prepared a 56-page audit report. Their summary:

In using Greyball, Uber has sullied its own reputation and cast a cloud over the TNC industry generally. The use of Greyball has only strengthened PBOT’s resolve to operate a robust and effective system of protections for Portland’s TNC customers.

PBOT continued:

As the agency responsible for ensuring the safety of TNC customers and the integrity of the TNC market, PBOT views Uber’s failure to comply with deep concern. This failure calls into question Uber’s commitment to comply in general with the City of Portland’s regulatory framework. It also raises questions about Uber’s ability to be a trustworthy partner in PBOT’s efforts to ensure that Portland’s TNC customers receive safe and reliable service.

PBOT searched for evidence of Uber continuing to use Greyball, or of Lyft doing so. They found no such evidence, though they noted that “It is inherently difficult to prove a negative.”

London Police said Uber “aware of criminal activity and yet haven’t informed the police”

In an April 2017 letter, the London Metropolitan Police questioned why Uber had not notified the police about criminal offenses known to Uber. The Police reported Uber refusing to provide information within its custody unless the police submit a formal request, and also refusing to report crime to the police because such reports may breach rights of a passenger. The Police questioned Uber’s approach, saying that Uber is “allowing situations to develop” that affect public safety, and noting also that the extra steps Uber calls for can impede prompt prosecution and ultimately lead perpetrators to go free.

The letter’s conclusion:

The significant concern I am raising is that Uber have been made aware of criminal activity and yet haven’t informed the police. Uber are however proactive in reporting lower level document frauds to both the MPS and LTPH. My concern is twofold, firstly it seems they are deciding what to report (less serious matters / less damaging to reputation over serious offences) and secondly by not reporting to police promptly they are allowing situations to develop that clearly affect the safety and security of the public.