Sen. Franken Presses Uber to Upgrade Privacy Policy, Protect Users Sensitive Location Data

[FrodosNewPet]

Sen. Franken Presses Uber to Upgrade Privacy Policy, Protect Users’ Sensitive Location Data

Recent Uber App Update Reduced Customers’ Control Over Their Location Data

https://www.franken.senate.gov/?p=press_release&id=3593

Wednesday, December 21, 2016

Today, in response to Uber's latest iPhone app update—which significantly reduced users' ability to control the company's access to their location information—Sen. Al Franken urged the popular ride-hailing company to upgrade its privacy policy to ensure that sensitive customer data is properly safeguarded.

Last month, as part of a major update, Uber eliminated users' ability to allow the app to access their location only "while using the app." Users are now forced to choose between "always" allowing Uber to access their location-even when the app is in the background and not being used-or "never" allowing Uber to access their location, leaving customers with imprecise pick-up and drop-off information.

In a letter sent today to Uber CEO Travis Kalanick, Sen. Franken said that while Uber's latest update may provide significant consumer benefits, the company should identify steps it can take to restore users' control over their sensitive location information and provide easy access to a clear and comprehensive privacy policy for their customers.

"While the stated justifications for this update appear well-intentioned, I strongly believe that American consumers deserve a meaningful opportunity to decide for themselves the fate of their personal data," Sen. Franken wrote. "At the very least, consumers have a right to clear and comprehensive information about what data are being collected about them, how the data are being treated, and with whom the data are being shared. To achieve this necessary transparency, I urge you to amend Uber's privacy statement to reflect the company's public assurances and justifications related to the most recent app update."

~ snip ~

[FrodosNewPet]

1. The letter Sen. Franken wrote

December 21, 2016

Mr. Travis Kalanick
Chief Executive Officer
Uber Technologies, Inc.
1455 Market Street
San Francisco, CA 94103

Dear Mr. Kalanick:

I am writing regarding Uber's latest iPhone app update, which has reduced users' ability to control the company's access to their sensitive location information. While the stated justifications for this update appear well-intentioned, I strongly believe that American consumers deserve a meaningful opportunity to decide for themselves the fate of their personal data. At the very least, consumers have a right to clear and comprehensive information about what data are being collected about them, how the data are being treated, and with whom the data are being shared. To achieve this necessary transparency, I urge you to amend Uber's privacy statement to reflect the company's public assurances and justifications related to the most recent app update.

As part of a major app update in November, Uber eliminated iPhone users' ability to limit the app to access their location only "while using the app." Users are now forced to choose between "always" allowing Uber to access their location - even when the app is in the background and not being used - and "never" allowing Uber to access their location, leaving both drivers and riders with imprecise pick-up and drop-off information. Since the update was launched, Uber has made numerous assurances that it will restrict its collection of users' location data to when a user is interacting with the app, when a user is on a trip, and for up to five minutes after a driver has ended a trip. According to Uber, this increase in location data collection will improve pick-ups and drop-offs, enhance safety, and prevent fraud - improvements that Uber alleges are not feasible under the "while using the app" location tracking option.

Given that the ride-sharing experience is still rapidly evolving, Uber's latest update may provide important consumer benefits. But renewed allegations regarding Uber employees' past abuse of customer data underscore the continued need for consumers to be able to make informed decisions about whether and with whom they share such sensitive information, and they must be assured that, when the information is shared, it will receive the utmost protection. To restore users' control over their location data, I urge you to consider implementing in-app options that are distinct from operating system-level permissions. Better controls could not only protect users' privacy, but encourage more engagement with Uber's services. However, at a minimum, to improve clarity, I strongly recommend that you make the following changes to Uber's privacy statement:

1. Collection of Location Information: Under "Information We Collect Through Your Use of Our Services," Uber's privacy statement provides that, if permitted, Uber "may also collect the precise location of [a user's] device when the app is running in the foreground or background." This section should be updated to explicitly state that Uber collects precise location information only when a user is interacting with the app, when a user is on a trip, and for up to five minutes after a driver has ended a trip.

2. Use of Location Information: Under "Use of Information," Uber's privacy statement details how the company may use the information it collects about a user. This section should be updated to reflect that post-trip location data is used only for the stated justifications for the app update, including to improve pick-ups and drop-offs, enhance safety, and prevent fraud.

3. Guide to Trip Related Location Data: Uber's privacy statement should include - where relevant - the information provided on the website's Trip Related Location Data page, including detailed information on how to disable location tracking, or provide a link to the page to ensure users have an easily accessible and comprehensive understanding of Uber's collection, treatment, and sharing of their location data.

4. User Notification: Under "Changes to the Statement," Uber's privacy statement provides that it will notify users when the company makes significant changes to the way it treats users' personal information or to the statement. To ensure users provide their meaningful consent to any such changes, including those that are recommended here, Uber should notify users through the app and through email.

I appreciate your ongoing willingness to engage with my office on issues of privacy, security, and consumer protection. Thank you for your prompt attention to this important matter, and please do not hesitate to contact me, or Leslie Hylton on my staff at [phone].

Sincerely,