~~~~~~
AG Laxalt and 49 States Reach Bipartisan $148 Million Settlement With Uber Over Data Breach; Affected Drivers may Receive $100 Payments
September 26, 2018
Carson City, NV – Today, Nevada Attorney General Adam Paul Laxalt, along with 49 other states and the District of Columbia, announced an agreement with California-based ride-sharing company Uber Technologies, Inc. The settlement addresses the company’s one-year delay in reporting a data breach to its affected drivers and customers. Settlement funds will be used to strengthen and enhance one of Nevada’s highest-priority data libraries—The Nevada Central Repository for Records of Criminal History, used for background checks—coordinate with the recommendations of AG Laxalt’s School Safety Report. Moreover, Uber drivers affected by the data breach may be eligible for a $100 compensatory payment.
In November 2016, Uber learned that hackers gained access to personal information that Uber maintains about its drivers, including the driver’s license information of approximately 600,000 drivers nationwide. Uber pursued the hackers and obtained assurances that the information had been deleted. However, Uber failed to report the breach of personal information to affected individuals, as required by law. Uber waited until November 2017 to report the incident. As a result of this national settlement with Uber, Nevada will receive $1,135,514.
“Consistent with the recommendations in my office’s School Safety Report, I am proposing that this settlement money be used to implement enhancements to Nevada’s background check system, one of the State’s most critical data libraries,” said Laxalt. “This is another step towards putting in place the most significant enhancement of Nevada’s comprehensive background check system since its inception–ensuring we are doing everything we can to keep guns out of the hands of dangerous individuals. Enhancing technology that supports our background check system will make our schools that much safer. I am also extremely proud that a portion of this settlement money will be used to put restitution into the hands of affected Uber drivers.”
Under the terms of the settlement, Uber has agreed to strengthen its corporate governance and data security practices to help prevent a similar occurrence in the future. As part of the agreement, Nevada will provide each eligible Uber driver in the State whose driver’s license numbers were accessed during the 2016 breach with a $100 payment. Some eligible drivers may no longer be driving for Uber. A settlement administrator will be appointed to provide notice and payment to eligible drivers, and details about this process will be announced by this office after October 25, 2018, the effective date of the settlement.
Additionally, the settlement between the state of Nevada and Uber requires the company to:
- Comply with Nevada data breach and consumer protection laws regarding protecting Nevadans’ personal information and notifying them in the event of a data breach concerning their personal information;
- Take precautions to protect any user data Uber stores on third-party platforms outside of Uber;
- Use strong password policies for its employees to gain access to the Uber network;
- Develop and implement a strong overall data security policy for all data that Uber collects about its users, including assessing potential risks to the security of the data and implementing any additional security measures beyond what Uber is doing to protect the data;
- Hire an outside qualified party to assess Uber’s data security efforts on a regular basis and draft a report with any recommended security improvements. Uber will implement any such security improvement recommendations; and
- Develop and implement a corporate integrity program that will hear any ethics concerns that Uber employees have about any other Uber employees to the company.
All 50 states and the District of Columbia are participating in this multistate agreement with Uber. Senior Deputy Attorneys General Lucas J. Tucker and Laura M. Tucker of the Attorney Generals’ Bureau of Consumer Protection represented Nevada in this matter.
In June 2018, AG Laxalt released his office’s School Safety Report following a Special Law Enforcement Summit on School Safety where law enforcement officials, school resource officers, educators, school administrators, and physical security experts discussed and assessed the vulnerabilities of Nevada’s schoolchildren. Today’s announcement is consistent with a recommendation featured in the report to improve and enhance Nevada’s current technological system for running background checks and obtaining detailed criminal history information on suspects and assailants. It is essential that records housed by the Central Repository be as current and comprehensive as possible because they serve a critical public safety function and ultimately make Nevada’s schools safer when properly accessed and used for purposes of threat assessment and to keep firearms out of the hands of dangerous individuals. In July, AG Laxalt’s office applied for federal funding through the School Violence Prevention Program, a $25 million nationwide grant program administered by the U.S. Department of Justice Office of Community Oriented Policing Services.
###