State to get $26M of Uber data breach settlement money

Uber Technologies Inc. agreed to pay $148 million in a nationwide settlement over a 2016 data breach, of which California will receive $26 million, Attorney General Xavier Becerra announced Wednesday.

But while speaking at a news conference in San Francisco, Becerra also took the rare step of criticizing the Legislature for not giving his office the necessary resources to enforce a new data privacy law. This follows an Aug. 22 letter to lawmakers stating the California Consumer Privacy Act of 2018 "imposes several unworkable provisions" on his office.

The money Uber is paying California comes from a 50-state settlement. It stems from an incident in which hackers stole information of 57 million Uber users and drivers. This included names and driver's license numbers of 174,000 drivers in California.

The company paid the hackers $100,000 to cover up the breach and didn't report it to the authorities. The company's board of directors discovered the breach in late 2017.

In addition to the money, the company agreed to improve its data protection policies and report all data breaches quarterly for two years. Becerra emphasized that consumers and drivers whose data was compromised are still able to take legal action as well.

"That was not part of our settlement," Becerra said. "That stays alive if there's an individual who has a claim to make."

He went on to say much of the money will be used to fund "more enforcement actions to make sure we are protecting consumers in the future." Some will also go to San Francisco District Attorney George Gascon's office, which partnered with the California Department of Justice in the case.

Gascon said the settlement will have an important deterrent effect.

"They came in with the attitude that 'we are going to ask for forgiveness later,'" Gascon said of Uber, adding that he is hopeful the company is "moving in a different direction ... under new leadership."

Becerra also briefly touched on a meeting he attended with U.S. Attorney General Jeff Sessions, several state attorneys general and other high-level officials on Tuesday. He said internet privacy was "the main topic of discussion" and the parties have agreed to meet again.

Then Becerra was asked about the California Consumer Privacy Act. It consists of two bills: AB 375, which Gov. Jerry Brown signed in June, and SB 1121, a series of amendments that Brown signed this past weekend. Both bills passed with overwhelming bipartisan support amidst the threat of a well-funded initiative campaign that would go around the Legislature.

Beginning in 2020, the act will give California consumers an unprecedented right to demand internet-based companies tell them what data they are gathering about them, limit how these companies use that data and force the companies to erase information.

Becerra fought a quiet, unsuccessful battle for months seeking changes to the bill. In the August letter to legislators, he wrote the law "imposes several unworkable obligations and serious operational challenges" on his office.

He warned that the requirement that complaints first be filed with his office was unnecessary and would create "the unprecedented obligation of using public funds to provide unlimited legal advice to private parties."

Becerra said he intends to "vigorously enforce" the new law, which he called the most far-reaching state-level legislation on internet privacy in the nation. But, he added, "There are some mechanical aspects of the law we would like to see changed."

"We need to be able to beef up our staff to do not just the enforcement component but now essentially the regulatory component, which is something the Department of Justice is not typically asked to do," he said.

Becerra ended with a plea for more time and resources, saying what they have "won't be enough; we made that pretty clear."

"We will continue to work with the attorney general to ensure that his office has the resources to enforce the law," said Assemblyman Ed Chau, D-Monterey Park, in an emailed statement.