Uber Now Tracks Passengers’ Locations Even After They’re Dropped Off

Remember: If you're not in the USA, then US law doesn't protect your privacy! And US privacy law is nothing like EU privacy law.

Has Uber considered reforming as a European company, under EU data protection law? That would a nice way to show that you take privacy very seriously.

I might be with you on the others, but [3] is just media hysteria based on faulty logic.

I've seen this type of story repeatedly after there's been an incident in some city. If it's not Uber it's a hotel chain or similar. It's easy clicks for tabloid newspapers. They probably have a template for this sort of story ready to go. And there will be plenty more ammo for this sort of thing as more companies move to automated pricing models.

Almost everyone who had to pay surge prices that day would not have been directly involved in the explosion (or even seen it). Are companies now supposed to compensate for any bad thing that might be happening in somebody's life? Presumably those who chose to pay surge prices did so because it was still the cheapest/best way of getting home. So even at those prices Uber was better than any alternative.

EDIT: Forgot to mention, it's also possible some people might have only got home that night because of surge pricing, because it increases the number of drivers.

If I had to buy a very expensive airline ticket at the last minute to see a sick relative, would the airline be exploiting me?

Previous HN discussion and article on the Copenhagen Interpretation of Ethics, which is relevant here:

https://news.ycombinator.com/item?id=10367855

A few things that speak a lot:

- Algorithmic Labor and Information Asymmetries: A Case Study of Uber’s Drivers https://papers.ssrn.com/sol3/papers.cfm?abstract_id=2686227

- Uber: The Big Data Company http://www.forbes.com/sites/ronhirson/2015/03/23/uber-the-bi...

- How Uber is Selling all Your Ride Data http://www.investopedia.com/articles/investing/030916/how-ub...

- How Uber Profits Even While Its Drivers Aren't Earning Money http://motherboard.vice.com/read/how-uber-profits-even-while...

- Uber claims US regulators collected data from 11m passengers https://www.theguardian.com/technology/2016/apr/12/uber-us-r...

The problem is not when a company is suddenly deciding to do something outright evil.

The problem is when the company starts slowly pushing the boundaries in ways that can be justified if you squint right.

E.g. consider this extra tracking. The feature in itself is fine, as long as the data is protected well enough and not abused.

The problem is that staff not used to think about nefarious uses are likely to defend this kind of collection without thinking about all the tiny little privacy implications.

So when a less moral person suggests a little tweak here or a little tweak there and justify it with a seemingly ok reason, it is likely to fly straight past a lot of people.

Another little change here and there, and suddenly things start to fall out of it that wasn't intended.

How many IBM engineers in the 20's and 30's had any inkling that their work on tabulating machines would aid in the Holocaust? Most would presumably have been horrified. Even the IBM execs that negotiated IBMs deals with Hitler would likely have been utterly horrified. Each little step was just one tiny step further from the last, and most had plausible positive spin on them. And the worst was hidden from them.

This is the difficult part of ensuring the morality of corporations, or organizations, or society in general: It is incredibly hard to get a sufficient overview to be able to predict whether any given action will contribute to an immoral outcome. Even when you're right there, "flicking the switch" that finally ties it all together. It's just one more tiny step, that from ground level will often not seem any different than the last step, which turned out ok.

EDIT:

The only way of ensuring the a corporation acts morally, is not to act morally, but to act specifically to take steps that binds the corporation so it is unable to do bad things:

Make sure you don't have data that can be abused, if at all possible, or at least destroy it as soon as possible.

Make sure you have systems that actively prevent staff from accessing data they have no need for.

Consider if you can transform data in ways that makes it less intrusive (e.g. if you don't need the full precision of certain location data, reduce the precision; if you don't need to be able to tie it to a certain individual, anonymise; if you only need aggregate/summary data, aggregate/summarise as early as possible and aggressively purge the raw data).

Ever barrier you remove from access to data, creates opportunities for innocent-sounding requests that turns out to have immoral reasons.

E.g. I've had managers request data from ex-customers that wuld have been in backups except for aggressive policies on purging it, where it turned out that rather than legitimately e.g. wanting to help them recover data, said manager wanted to hand the data to another manager, without realising that said other manager was planning on mining said ex-customers data for sales leads for a new product that would directly compete with them.

Flagrant violation of our contracts, and of UK data protection laws. But the initial request sounded innocent enough, and I only found the reason because I'm extremely paranoid about these things. The manager that made the request didn't suspect a thing, for example.

Actually not having the data made refusing the request a lot easier, and also prevented the manager that wanted the data from trying to find ways around me.

The problem is that you need only one employee without moral concerns but with the necessary data-access and the data you are collecting can be used to abuse your customers. At my former employer I had access to cell-phone usage data and for example I could have tracked the calls and geolocation of my girlfriend. Only becasue database grants were assigned automatically to everyone who required them.

The only secure way of collecting data is not collecting data at all.