Uber to dole out $148m settlement among US states over breach it paid $100k to bury Uber will pay $148m to US state authorities in a settlement for the 2016 data breach that saw hackers steal information on 57 million people. The firm covered up the hack – which exposed names, email addresses and phone numbers of drivers and customers – for almost a year. It also attempted to bribe the thieves, offering them …
Yeah, I've seen auditors browbeaten into submission. There's a fundamental conflict of interest in the PCI DSS standard simply because external auditors can be replaced if they get too finicky. But, what do you expect from a regulatory standard created by the banking industry.
That information was linked in the article, but for this particular issue (emphasis added), just keep reading...
"California Attorney General Xavier Becerra and San Francisco District Attorney George Gascón today announced a $148 million nationwide settlement resolving allegations that Uber Technologies, Inc. (Uber) violated state data breach reporting and reasonable data security laws in connection with its 2016 breach of driver and customer data. Uber is accused of exposing 57 million users’ data and paying hackers to cover up the breach rather than reporting it to proper authorities. "
It doesn't stop there, of course. This page has a number of examples:
https://www.quora.com/What-are-all-the-laws-Uber-has-broken
More telling is that there is a Wikipedia page set up for this very topic:
https://en.wikipedia.org/wiki/Uber_protests_and_legal_actions
Well, I did read the whole thing. I'm used to seeing the actual wording of the law(s) on here (the relative section at least). Dunno, maybe it's just too much text to paste in, laws can't get lengthy (especially the interpretation of). However, I like to see these laws as the laws of privacy are on a new front and seem to amend frequently.
I'll check your links, but I'm not a fan of Uber's practices and I am still wondering if they broke only 1 law (not that it matters as judgement has been given).
Companies in California and throughout the nation are entrusted with customers' valuable private information. This settlement broadcasts to all of them that we will hold them accountable to protect their data.
That's damn right, Uber! You can't GIVE away customers' valuable private information. You have to SELL it on to as many useless assbags as possible who will use it for endless spam and "targeted advertising" instead!
What was that about data protection laws that say you can't just sell everyone's data? Yeah, that's some sort of European thing, maybe, but no such limits here in the USA!
The Register 
Biting the hand that feeds IT
Copyright. All rights reserved © 1998–2024
