Skip to main content

An Uber car is seen parked with the driver's lunch left on the dashboard in this file photo.

Lucy Nicholson/Reuters

Uber Canada said late Monday that 815,000 Canadian riders and drivers may have been affected as part of its worldwide data breach announced in November.

The disclosure came the same day the federal privacy commissioner said it had opened a formal investigation into the data breach, which saw the theft of information from some 57 million Uber accounts globally in October, 2016.

Uber said the information taken includes names, email address, and mobile phone numbers from the accounts, but that its investigation has not identified any location history, credit card numbers, bank account numbers, or dates of birth were downloaded.

Story continues below advertisement

Uber Canada spokesman Jean-Christophe de le Rue said the company will co-operate with the commissioner's investigation.

"The privacy of riders and drivers is of paramount importance at Uber and we will continue to work with the privacy commissioner on this matter."

News of the breach prompted authorities in the U.S. and U.K. to launch formal investigations immediately, while the commissioner in Canada initially asked that Uber file a report explaining how the breach happened and its impact on Canadians.

The privacy commissioner gave little detail in announcing the now formal investigation, noting confidentiality provisions under the Personal Information Protection and Electronic Documents Act.

The commissioner's investigation was prompted by a letter from a parliamentarian, said spokesman Tobi Cohen.

Details of the number of Canadians affected also comes after Toronto city council voted last week to demand information from the company on the breach, based on requirements in their license agreement with the city.

The company is also facing lawsuits, including one from Washington State, for failing to disclose the breach despite laws requiring it to do so.

Story continues below advertisement

Federally, Canada doesn't have laws requiring companies disclose data breaches, though Alberta does have requirements in place. The province said it had also launched an investigation.

Changes to federal privacy laws are under way that would make it a requirement, with public consultations closed in October, but under the proposed revision the privacy commissioner would be limited to issuing a maximum $100,000 fine for not disclosing a breach.

Attention on data breaches have increased after numerous high-profile incidents including the Equifax breach earlier this year that included data on 145 million Americans and about 19,000 Canadians.

Report an error
Comments

Welcome to The Globe and Mail’s comment community. This is a space where subscribers can engage with each other and Globe staff. Non-subscribers can read and sort comments but will not be able to engage with them in any way. Click here to subscribe.

If you would like to write a letter to the editor, please forward it to letters@globeandmail.com. Readers can also interact with The Globe on Facebook and Twitter .

Welcome to The Globe and Mail’s comment community. This is a space where subscribers can engage with each other and Globe staff. Non-subscribers can read and sort comments but will not be able to engage with them in any way. Click here to subscribe.

If you would like to write a letter to the editor, please forward it to letters@globeandmail.com. Readers can also interact with The Globe on Facebook and Twitter .

Welcome to The Globe and Mail’s comment community. This is a space where subscribers can engage with each other and Globe staff.

We aim to create a safe and valuable space for discussion and debate. That means:

  • All comments will be reviewed by one or more moderators before being posted to the site. This should only take a few moments.
  • Treat others as you wish to be treated
  • Criticize ideas, not people
  • Stay on topic
  • Avoid the use of toxic and offensive language
  • Flag bad behaviour

Comments that violate our community guidelines will be removed. Commenters who repeatedly violate community guidelines may be suspended, causing them to temporarily lose their ability to engage with comments.

Read our community guidelines here

Discussion loading ...

Due to technical reasons, we have temporarily removed commenting from our articles. We hope to have this fixed soon. Thank you for your patience. If you are looking to give feedback on our new site, please send it along to feedback@globeandmail.com. If you want to write a letter to the editor, please forward to letters@globeandmail.com.
Cannabis pro newsletter