Uber found to have breached privacy of 1.2 million Aussies in 2016

Privacy watchdog releases findings of investigation.

long-awaited determination, disclosed the breach, US$148 million settlement

Uber failed to appropriately protect the personal data of more than a million Australian customers and drivers when it was compromised in a 2016 hack, the privacy commission has found.

In a long-awaited determination released on Friday, privacy commissioner Angelene Falk revealed the global ride sharing company had interfered with the privacy of 1.2 million Australians by failing to comply with the Privacy Act.

The determination follows a “complex” investigation into US-based Uber Technologies and its Dutch-based subsidiary, Uber B.V, following a cyber attack that took place in October and November 2016.

Uber disclosed the breach – which impacted 57 million users and drivers globally – in November 2017 and reported it to the Office of the Australian Information Commissioner in December 2017.

The company paid the attackers US$100,000 at the time to delete the stolen data, which included the names, email addresses and mobile phone numbers of customers, and keep quiet.

On Friday, the OAIC said Uber had breached the Privacy Act by “not taking reasonable steps to protect Australian’s personal information for unauthorised access and to destroy or de-identify the data as required”.

The commission said the company also “failed to take reasonable steps to implement practices, procedures and systems to ensure compliance with the Australian Privacy Principles”.

“Rather than disclosing the breach responsibly, Uber paid the attackers a reward through a bug bounty program for identifying a security vulnerability,” OAIC said in a statement on Friday.

“Uber did not conduct a full assessment of the personal information that may have been accessed until almost a year after the data breach and did not publicly disclose the data breach until November 2017.”

Falk said that regulatory action was warranted in Australia following the cyber attack, but did not go as far as imposing a fine like the UK's Information Commissioner's Office (ICO) did in 2018.

In addition to the fines, which ammounted to 385,000 pounds in the UK and 600,000 euros in Holland, Uber also agreed to pay a US$148 million settlement with 50 US states and Washington DC in September 2018.

In Australia, the OAIC has ordered Uber to prepare a data retention and destruction policy, information security program and incident response plan within three months, as well as appoint an independent expert to review the actions and report to OAIC within five months.

“We need to ensure that in future Uber protects the personal information of Australians in line with the Privacy Act,” Falk said.

Falk added that the matter also “raises complex issues around the application of the Privacy Act to overseas-based companies that outsource the handling of Australians’ personal information to other companies within their corporate group”.

The determination reveals the personal information of Australians was transferred to servers in the US under an outsourcing arrangement, which Uber argued was not subject to Australia’s privacy laws.

“This determination makes my view of global corporations’ responsibilities under Australian privacy law clear,” Falk added.

“Australians need assurance that they are protected by the Privacy Act when they provide personal information to a company, even if it is transferred overseas within the corporate group.”

In response to the determination, Uber said it had made a series of technical improvements since the incident, including “obtaining ISO 27001 certification of our core rides business information systems and updating internal security policies”.

“We are confident that these changes in security and governance will address the determination made by the OAIC, and will work with a third-party assessor to implement any further changes required,” a spokesperson said.

“We welcome this resolution to the 2016 data incident. We learn from our mistakes and reiterate our commitment to continue to earn the trust of users.”

Updated at 4:38pm to include Uber statement

News Related


Construction restrictions to lift in NSW, unvaccinated workers permitted to return to work

© Provided by ABC Business An empty construction site in south-west Sydney during its lockdown. (ABC News: Brendan Esposito) The NSW construction industry will return to 100 per cent capacity in ... Read more »

Health Minister Greg Hunt asks Pfizer to apply for under 12s COVID vaccine approval in Australia

The Health Minister has encouraged Pfizer to apply to have its vaccine approved for kids aged under 12 in Australia at the same time as it applies for approval in the ... Read more »

New WA vaccination ad tackles hesitancy as Premier flags tougher border restrictions with Victoria

Apathy and lives unaffected by the pandemic are the reasons almost 40 per cent of West Australians are yet to get a COVID-19 vaccination, according to Vaccine Commander Chris Dawson, ... Read more »

Young boy with rare form of cancer helps solve bike theft case

A young boy with a rare form of cancer has helped police in Queensland’s Western Downs Region solve a bike theft case on his very first shift as a special ... Read more »

Global shipping mess, supply chain delays to 'last until 2023'

Australian shoppers eyeing certain Christmas presents have already missed their chance to get them under the tree, a freight expert has cautioned, because of the global shipping crisis and an ... Read more »

Govt 'balancing act' on NSW kids' bubble

NSW’s COVID-19 “balancing act” justifies the creation of a “kids’ bubble” to bring some relief to locked down families during the school holidays, the health minister says. © Dan Himbrechts/AAP ... Read more »

Qld cuts Tweed, Byron from border bubble

Queensland will remove Byron Bay and Tweed Heads from the border bubble after the NSW government ordered those shires into a seven-day COVID-19 lockdown. © Albert Perez/AAP PHOTOS Annastacia Palaszczuk ... Read more »

‘We need to wait for the science': Under 12s unlikely to get vaccine before Christmas

© Getty About one in three cases during Sydney’s Delta outbreak have been in the 0 to 19 age group. COVID-19 vaccination for children aged under 12 is unlikely to ... Read more »

NSW Covid update: Byron Bay, Tweed and Kempsey in lockdown as cases and deaths rise

Children and adolescents in New South Wales will be able to visit each other at home – in a “friends bubble” – with the state continuing to ease coronavirus restrictions ... Read more »

Rex to become Australia's first airline to fully vaccinate frontline staff by November 1

© Provided by ABC Health All of Rex’s frontline staff will be fully vaccinated by November 1. Workers who are unvaccinated will be redeployed. (Supplied: Rex) Regional carrier Rex says ... Read more »

Complaints mount as Caboolture Hospital inquiry scope remains unchanged

© AAP An inquiry into surgeries at Caboolture Hospital is currently under way. An inquiry into Caboolture Hospital will “consider all calls seriously”, according to Queensland Health, but it has ... Read more »

Study shows Aust sharks' extinction risk

More than one-in-ten of Australia’s shark, ray and ghost shark species are at risk of extinction, with experts warning “urgent action” is needed to stop severe population declines. © PR ... Read more »

COVID vaccines at schools likely next year

Doctors have backed vaccinating children aged between five and 11 against coronavirus in schools as early as next year.  © Lukas Coch/AAP PHOTOS AMA president Omar Khorshid has backed vaccinating ... Read more »

Children make up a third of ACT outbreak

Children account for nearly a third of the coronavirus infections in Canberra’s latest outbreak, with the majority of them too young to be eligible for vaccination. © Lukas Coch/AAP PHOTOS ... Read more »

Adorable moment an infant sees a dog for the first time

© Provided by Daily Mail MailOnline logo A baby girl born during the height of the Covid-19 pandemic had an adorable reaction after seeing a pair of dogs for the ... Read more »

Settled Lever eyes AFL grand final return

Meditation and family FaceTime calls are helping to settle Jake Lever, who will enter the AFL premiership decider as the only Melbourne player with previous grand final experience. © Matt Turner/AAP ... Read more »

SA to return to some dancing and stand-up drinking as COVID-19 testing requirements for Queensland travellers dropped

© Provided by ABC Health South Australians will be able to stand up and drink in beer gardens and other outdoor venues from Thursday, with the state’s authorities also set ... Read more »

RBA warns of slow rebound from lockdowns

The Reserve Bank of Australia has warned the recovery from the expected economic downturn in the September quarter could be slower than previously experienced during the COVID-19 pandemic. © James ... Read more »

Who is Atlantis on The Masked Singer?

© Provided by Are Media Pty Ltd The Masked Singer Australia is back for 2021 and social media is in overdrive as fans try to guess who is hiding under ... Read more »

Labor endorses ex-serviceman for Qld seat

Two ex-servicemen will slug it out for the Queensland seat of Herbert when Australia heads to the polls, with Labor endorsing a former RAAF member. © Mick Tsikas/AAP PHOTOS Liberal ... Read more »

Backflip as Annastacia Palaszczuk says she WILL follow national plan

© Provided by Daily Mail MailOnline logo Annastacia Palaszczuk has hosed down reports Queensland’s borders will remain closed until the state hits a 90 per cent double-dose vaccination rate. The ... Read more »

'Mustering cats': Joyce on stubborn states

Barnaby Joyce has likened striking unanimous state agreements on coronavirus to mustering cats as he warned an ongoing zero-case pursuit would lead to economic collapse. © Lukas Coch/AAP PHOTOS Australia ... Read more »

Qld quarantine escapee refused bail

A woman accused of forcing a door to break out of hotel quarantine in Queensland and going on the run for days has been refused bail. © Samantha Manchee/AAP PHOTOS ... Read more »

Infected authorised worker triggers Northern NSW lockdown

© Getty Byron Bay is one of the LGAs in Northern New South Wales that will enter a snap lockdown.. The Tweed, Byron Bay and Kempsey local government areas in ... Read more »

Melbourne protesters march down city streets lighting flares, fireworks

© Nine Protesters were chanting Hundreds of riled-up protesters are rallying through Melbourne CBD streets after being warned to “leave now or force may be used”. Vision captured from the ... Read more »

Anthony Milford didn't assault partner but was allegedly violent

It can be revealed that NRL star Anthony Milford did not assault his partner and mother of his two children during a pre-dawn rampage but instead allegedly assaulted onlookers who ... Read more »

Far North Queensland tourism not bouncing back, school holiday numbers worse than expected

© Provided by ABC Business Green Island is a well-known holiday destination and sits just off Cairns in the Great Barrier Reef. (Supplied: Naomi Brookfield, file photo) The crowds are nowhere to ... Read more »

Farmers warn not to bog them down in bureaucracy in firefighting registration push

© Provided by ABC NEWS Farm fire fighting units played a big role during the 2020 bushfires on Kangaroo Island. (Supplied: Sabrina Davis) A trial to register private fire units ... Read more »

NSW records 1022 new local COVID-19 cases; lockdown reintroduced in Byron, Kempsey and Tweed LGAs

© Getty Hazzard encouraged locals to “take this very seriously”, expressing concern about low testing and vaccination rates in the region. NSW has reported 1022 new local coronavirus cases, as ... Read more »

Melbourne protest marches on after warning

A second violent clash outside Melbourne’s construction union headquarters has been avoided but hundreds of protesters are now marching towards state parliament. © James Ross/AAP PHOTOS Protesters clad in hi-vis ... Read more »

Queensland eyes Byron case as Tweed prepares for snap lockdown

© Getty Palaszczuk said the state had passed the milestone of 60 per cent of eligible Queenslanders having received a first dose of the vaccine. Queensland Premier Annastacia Palaszczuk has ... Read more »

NSW records 1,022 new COVID-19 cases and 10 deaths as 'friends bubble' for under 18s announced

NSW recorded 1,022 new locally acquired COVID-19 cases in the 24 hours to 8:00pm yesterday. There were 10 COVID-19 fatalities in the reporting period. A snap seven-day lockdown has been ... Read more »

Alleged Darwin shooter pleads not guilty

A man on trial for the shooting murders of four people in Darwin has pleaded not guilty as jury selection gets underway. © PR HANDOUT IMAGE PHOTO Benjamin Glenn Hoffmann ... Read more »

Model Ajak Deng turns stuns in a mini dress at London Fashion Week

© Provided by Daily Mail MailOnline logo She recently made a return to the modelling industry following a three-year hiatus. And South Sudanese-born Australian stunner Ajak Deng has been front ... Read more »

Melbourne Star faces $3.9m liquidation debt bill

© Eddie Jim The Melbourne Star Wheel in Docklands is set to be closed permanently due to COVID lockdowns. 6 September 2021. The Age News. Photo: Eddie Jim. The Melbourne ... Read more »

WA launches 'uplifting' vaccination campaign

© Getty West Australian Premier Mark McGowan hopes the new advertising campaign will help life the state’s vaccination numbers. WA Premier Mark McGowan has announced a new “uplifting” advertising campaign ... Read more »

Aukus row: European Union demands apology from Australia over France's treatment before trade talks

The European Union is demanding answers – and an apology from Australia – over its treatment of France as the fallout from the Aukus announcement threatens to delay a key ... Read more »

Higher borrowing costs for companies not hitting gender targets

© AAP “Targets need to be set and targets need to have teeth,” says Diane Smith-Gander, who chairs the Committee for Economic Development of Australia and buy now, pay later ... Read more »