I don't understand why one would need an agreement between Uber and the FTC explicitly mentioning this. Is it not illegal if a company misrepresents its compliance to the regulator?
> required to implement a comprehensive privacy program … > required to obtain within 180 days, and every two years after that for the next 20 years, independent, third-party audits certifying that it has a privacy program in place that meets or exceeds the requirements of the FTC order
This is worth noting, it clearly alludes to a need for "privacy champion" (or "privacy engineer/compliance officer/deputy CIO") for any business that deals with sensitive (to regulatory compliance) personal information. It's not enough to write a token "/about/privacy.html" and relegate any and all of the system requirements that arise due to regulatory compliance.
I hope other startups take note of this, and plan to allocate resources to this in their roadmap. I don't care when exactly you plan to do it - make sure it's there in your TODO list of things before the regulator comes knocking on your doors.
Also, I was unable to find any number or estimate of cost of compliance mentioned in the settlement. I would really prefer when a government agency agrees to settle with a business they make it public how much the business was fined as well as the future cost of compliance. This information would hopefully make it clear to future businesses to take privacy issues seriously.
Breach of a consent order is a fast track into the court supervising the order, and the terms are usually more specific (and thus easier to demonstrate) than the underlying law, and violating the consent order can risk basically reopening the original litigation with it full potential consequences (not just those for the narrow violation the provision of the order at issue would involve under the bare law), so often consent orders will have restrictions that are special cases of restrictions that already exist in law.
Imagine how deep the hands go or who is on Uber side that the result of FTC settlement is statement tht forbids Uber from... breaking the law. Amazing! Me and you would be heading to jail for the claims they did. Not uber.
It also somehow reminds me of 911 commision. It eventually got so sidetracked that the result of the findings were that pretty much two planes hit towers and then they collapsed. End of investigation.
(2) this is a pretty good ruling in that it can't put the horse back into the barn but it can make sure Uber ups their game.
(3) this has absolutely nothing whatsoever to do with 9/11, either peripherally or through analogy, and misrepresenting the findings of the 911 commission to this extent is pretty poor. I have some friends who are total conspiracy nuts when it comes to 9/11 and even they do a better job that this.
For a particular six-month period, Uber only monitored access to the account information of a select group. Who? Certain high-profile users, including Uber executives.
What was the upshot? In May 2014, an intruder used an access key an Uber engineer had publicly posted on a code-sharing site to access the names and driver’s license numbers of 100,000 Uber drivers, as well as some bank account information and Social Security numbers. The FTC says Uber didn’t discover the breach for almost four months.
The proposed settlement prohibits Uber from misrepresenting its privacy and security practices. It also requires Uber to put a comprehensive privacy program in place and to get independent third-party audits every two years for the next 20 years. You can file a public comment about the settlement until September 15, 2017.
The complaint: https://www.ftc.gov/enforcement/cases-proceedings/152-3054/u...
Links from complaint:
Agreement Containing Consent Order (19.87 KB) https://www.ftc.gov/system/files/documents/cases/1523054_ube...
Decision and Order (57.66 KB) https://www.ftc.gov/system/files/documents/cases/1523054_ube...
Complaint (35.88 KB) https://www.ftc.gov/system/files/documents/cases/1523054_ube...
Complaint Exhibits A and B (1.2 MB) https://www.ftc.gov/system/files/documents/cases/1523054_ube...
Analysis of Proposed Consent Order To Aid Public Comment (56.14 KB) https://www.ftc.gov/system/files/documents/cases/1523054_ube...
Press release: Uber Settles FTC Allegations that It Made Deceptive Privacy and Data Security Claims https://www.ftc.gov/news-events/press-releases/2017/08/uber-...
Settlement agreement quote:
Under its agreement with the Commission, Uber is:
prohibited from misrepresenting how it monitors internal access to consumers’ personal information;
prohibited from misrepresenting how it protects and secures that data;
required to implement a comprehensive privacy program that addresses privacy risks related to new and existing products and services and protects the privacy and confidentiality of personal information collected by the company; and
required to obtain within 180 days, and every two years after that for the next 20 years, independent, third-party audits certifying that it has a privacy program in place that meets or exceeds the requirements of the FTC order.