Uber claims US regulators collected data from 11m passengers

Uber has claimed that transport regulators collect too much data on its passengers and drivers, marking the latest chapter in the ride-hailing giant’s fraught relationship with authorities.

In its transparency report released on Tuesday, Uber showed that state and local agencies – such as public utility and taxi commissions – requested data affecting more than 11m user accounts and half a million drivers between July and December 2015.

Regulators use the data to monitor the volume of rides and the drivers’ Uber uses. The data is anonymized, but still includes GPS coordinates, addresses and route maps. Since some of the data is available to the public through records requests, the practice raises privacy issues for customers and competitive concerns for Uber, the company argues.

“Of course regulators will always need some amount of data to be effective, just like law enforcement,” the company said in a blogpost. “But in many cases they send blanket requests without explaining why the information is needed, or how it will be used.”

It’s a controversial move by Uber, which has used a mix of charm and confrontation to navigate regulation in new markets. In this case, the company has won the support of several pro-privacy groups that had been briefed on the data.

“That kind of stuff is quite revealing particularly in conjunction with other data,” such as home addresses, said Jim Harper, a senior fellow at the libertarian-prone Cato Institute in Washington. “Even if my name isn’t on it you’re going to see it’s me pretty quick.”

In 2015 Gautam Hans, policy counsel at the Center for Democracy and Technology, published a paper raising concerns about the unregulated nature of the data regulators collect through “sharing economy” services. One researcher claimed to have determined which cab Bradley Cooper rode in after matching 2014 data from a New York taxi database with paparazzi photos.

“There isn’t a lot of systemic or constitutional limits on what they could in the future collect,” Hans said.

Regulators say they collect this data to ensure transportation companies properly serve the public. In January, a California judge ruled Uber should be fined for failing to provide enough driver data to the state Public Utilities Commission.

The agency didn’t return a request for comment.

In a blogpost, Uber said it wants to provide some data to regulators but feels that it is often asked to provide more (such as GPS data) than taxi companies, which don’t all collect such detailed trip data.

Uber’s fight over government data collection is unique from its Silicon Valley brethren. Companies such as Yahoo, Google, Apple and Facebook have picked fights over national security and law enforcement data requests. To that end, Uber has received relatively few.

During the second half of 2015, state, local and federal law enforcement requested data on 408 customer accounts and 205 driver accounts. Uber provided at least some data in about 85% of those cases, the company said.

Many of those cases were related to suspected credit card fraud, Uber said, adding that though that number might seem low, police can get data on trips from riders and drivers directly.

Uber also took an unusual step for a mainstream technology company. It installed included a so-called “warrant canary” in its freelance report when it declared it has not received a national security letter or a court order under America’s Foreign Intelligence Surveillance Act. Such generally secret government data requests often come with a gag order.

If Uber ever does receive such a request in the future it would, in theory, remove the language.