Uber shared personal information of its drivers with law enforcement agencies

Uber shared personal information of its drivers with law enforcement agencies if they put out an information request. The company did so for several years.

Last week, the Dutch data protection authority (DPA) imposed a € 290 million fine on Uber for illegally transferring personal data of European taxi drivers to servers in the United States, including location data, photos, identity documents, payment details, driver’s licenses, criminal records and medical information.

Leaked documents show us that Uber also hand-delivered sensitive and personal information of European drivers to law enforcement agencies all over the world. The company did so in order to get on good terms with intelligence agencies and police forces.

According to Dutch newspaper Trouw, which read the leaked documents, the Colombian government submitted an information request in 2018 for a specific driver to Uber’s headquarters, which is located in Amsterdam. Uber responded by sending a list of all rides, personal information and income of this driver.

Mark MacGann, former head of Uber’s European policy and communication department, tells Trouw it was a well-considered strategy to share information with law enforcement agencies. About ten years ago, the company was at odds with police and regulators from various countries and was looking for a way to get them back to being ‘pro-Uber’. “It was a strategy to get governments on our side,” MacGann says.

The Financieele Dagblad, another Dutch newspaper, states that Uber’s Chief Privacy Officer voiced his concerns regarding the outdated privacy policy back in 2015. “Please be aware that this already exposes us to legal risk as it is not compliant in many jurisdictions, including the EU,” she wrote in an email addressed to Pierre-Dimitri Gore-Coty, the current CEO of UberEats.

According to its website, Uber now only shares personal information of its drivers with law enforcement agencies within Europe. It’s unclear when the company stopped sharing personal data with law enforcement agencies outside Europe.

In a statement Uber says that the primary task of Uber’s public safety response team, which handles information requests, is to inform and work with law enforcement agencies to solve crimes. “The team reviews and responds to each request in accordance with its privacy policy and applicable laws and regulations,” the company explains.