FTC Uber Settlement Mandates A Comprehensive Privacy Program, Sheds Light On "Reasonable Data Security" Expectations, And Underscores Importance Of Insider Threat Prevention

On August 15, the FTC announced that it had reached an agreement with Uber to settle allegations that the company had made deceptive claims about its privacy and data security practices. The FTC's settlement with Uber has important implications for privacy and data security measures that companies could take, and the representations they and their employees make in these areas. It also shed greater light on what the FTC means by "reasonable data security" measures that companies should implement, and underscores the importance of maintaining a robust insider threat prevention program.

In 2014, Uber was the subject of news reports that alleged Uber employees could gain access to and use its customers' personal information, including sensitive information such as their detailed trip records with precise geolocation. Uber responded to those media allegations with statements promising that Uber closely monitored and audited employees' access to customer and