What does UBER do with its users’ data?

23 November, 2016

Comments are off for this post

Rosa Guirado

Newspaper article

A newspaper article yesterday stated that UBER had included a new clause in its web terms and conditions changing its privacy policy.

According to the news item published:

“The clause concerned appears in section 4, of “Access and use of the services”, under the title “Content provided by the user”. This explains that Uber may allow its users to send different types of content to the application, and that the content shared by the user, according to what Uber affirms, will always be the property of the person who sent it.

However, the interesting part lies right in the following sentence:

“On providing Uber content, you are granting Uber a worldwide, perpetual, irrevocable, transferable right, free of author’s rights, with the right to sub-license, use, copy, amend, create material arising from same, distribute, publicly display and exploit said content in any way, in all the manners and in all the presently known distribution channels, or those that may be conceived hereafter (including both Uber and its associated services, as well as third party sites and services), without the need for notification to or permission from the user, and without having to pay the user or any entity”.”

UBER’s terms and conditions

We have examined the present terms and conditions of UBER in Spain (as they are published on its web page on 23.11.2016), where we found the following (that raises doubt regarding the exactness of the news item):

(1) There appears to have been no recent amendment of its Legal Terms (that, as published, date from 1st March 2016), nor its Privacy Policy (that, as published, dates from 15th July 2015).

(2) These clearly differentiate the treatment given to two distinct types of data:

(i) Personal data
- Both provided by the user (including: name, electronic mail, telephone number, postal address, profile photo, means of payment, articles requested (for delivery services), delivery notes and other information you may choose to provide),
- as well as data gathered by UBER while its services are used (an ample range covering: information on location, contacts, the operation, preferences, the device, call and SMS data, and registration information).

UBER protects such personal data under its Privacy Policy, recording user consent and reporting the purpose for which its use is intended and the receivers of such communication, as required by Organic Act 15/1999, on Personal Data Protection. The news does not refer to such personal data.

(ii) The content provided by the users to which UBER refers in the following clause 3 of its Legal Terms and Conditions (in force since last March):

Content provided by the User.

Uber may, at its sole discretion and when it considers appropriate, allow you to send, upload, publish or in any other way provide Uber text, audio and/or visual information through the Services, including comments and opinions regarding the Services, commencing requests for support, as well as submissions for competitions and promotions (“User content”). All User Content you provide shall continue to be your property. Notwithstanding this, by providing User Content to Uber, you grant a worldwide, perpetual, irrevocable, transferable right, royalty free, with the right to sub-license, use, copy, amend, create derivative works, distribute, publicly display exploit such User Content in any way, in all formats and distribution channels, known at present or those that may be conceived hereafter (included in relation to Uber’s Services and business and on third party services), with no further notice to you or your consent, and without requiring payment to yourself or any other person or entity.

You hereby declare and guarantee that: (i) you are the sole and exclusive owner of all the User Content, or that you hold all the rights, licenses, consents and permits required to grant Uber license to the User Content as established above; and (ii) neither the User Content nor its presentation, uploading, publication or provision of that User Content in any other way, nor use of the User Content by Uber as permitted herein, shall infringe, misappropriate or breach the intellectual property rights of a third party, or publicity or privacy rights, nor shall cause infringement of any applicable law or regulation.

You agree not to provide User Content that is defamatory, slanderous, hateful, violent, obscene, pornographic, illicit or in any other way offensive, as determined by Uber to its sole discretion, both if that material may be protected by law or not. Uber may, at its sole discretion and at any moment and for any reason, review, verify or eliminate User Content without providing you prior notice, although without being obliged to do so.

Conclusions

Considering all the above, we reach the conclusion that:

The company distinguishes between two data types provided by the user:
- the “personal” data provided by the users (that include name, electronic mail address, telephone number, postal address, profile photo, method of payment, articles requested (for delivery services), delivery notes and other information you choose to provide) and
- data provided by the user in the “User Content” category (according to the terminology of the Legal Terms and Conditions)
and the clause being debated is a very ample clause (drafted in American contractual style) that grants UBER absolute freedom with regard to the data provided by the users.

This could give rise to the following issues:

One regards the DATA: Does the company clearly differentiate, among the data provided by the users, those that are “personal” in nature, from those that are not? That is to say, does UBER provide a clear internal establishment of that “Chinese wall”, so that the ample nature of point 3 of its Terms and Conditions is applicable to the “” data provided by the user? Apart from the confusing terminology, there would appear to be no specific reason to think that UBER is not complying with its Legal Terms and Conditions or its Privacy Policy.
And another regarding the SCOPE. Is the freedom UBER claims over the “non personal” data provided by the users too wide ranging?

OCU against UBER’s Terms

The Spanish Consumers and Users’ Organisation (OCU) has come out clearly against the Legal Terms and Conditions of UBER. It considers that the clause transcribed is too ample a clause and, due to this, it publicly denounced it, under the following terms:

OCU denounces the abusive terms Uber sets for its users

22 Nov. 2016

The transport platform Uber imposes conditions in its legal terms, specifically in matters regarding user provided content, that may be considered abusive as the OCU considers they infringe the fundamental rights of consumers by creating an imbalance between both parties and limiting the users’ rights.

According to the text available on Uber’s web page, “by providing User Content to Uber, you grant a worldwide, perpetual, irrevocable, transferable right, royalty free, with the right to sub-license, use, copy, amend, create derivative works, distribute, publicly display exploit such User Content in any way, in all formats and distribution channels, known at present or those that may be conceived hereafter”, by providing the content the user permanently cedes it with no possibility of cancelling such rights held by the company.

The OCU also considers that, according to the text, Uber acquires the right to use such data for practically all ends it may deem appropriate without having to request prior approval by the consumer, even to exploit or publish such.

OCU demands that the company to eliminate that clause and issue the relevant correction for all users who may have accepted such clauses, from the moment of their amendment.

One must remember that, in February 2016, the OCU published a study on Collaborative Consumption in which, among other matters, it reviewed the legality of the Legal Terms and Privacy Policy of 23 of the collaborative platforms that were providing services in Spain during 2015 and, on the basis of this and other matters, provided a rating of such platforms, according to their triple impact: economic, legal and social.

One must also point out that, at that time, UBER did not provide services in Spain (as provision of UBER-POP services had been suspended after extreme injunctive measures were taken inaudita parte (without hearing the party concerned) by Mercantile Court no. 2 of Madrid, by virtue of the court order of 9th December 2014, and UBER had not even launched its service with passenger transport vehicle (VTC) licenses, for vehicles with a driver).