Uber Guidelines for Law Enforcement Authorities - Outside the United States

Uber is committed to continually improving the safety of our platform and contributing to safety in the communities where we operate. Uber has a specialized team dedicated to working with law enforcement agencies around the world, the Public Safety Response Team (“PSRT”). This team reviews and responds to each law enforcement request Uber receives. The PSRT team has processes in place to assist law enforcement on a 24/7 basis, including emergency requests, through our Public Safety Portal.

Uber is also committed to the privacy of our users’ data. Uber stores and maintains user data as described in our Privacy Notice and Terms of Use applicable to each jurisdiction where Uber operates. Uber discloses data to law enforcement in accordance with applicable laws and Uber’s core principles.

Up-to-date information about Uber’s products and services are available in our Help Center and Newsroom.

This guide, and the accompanying FAQs, are not intended to provide legal advice. They also do not create any enforceable rights, and Uber reserves the right to update or change this guide without notice to law enforcement.

PSRT Overview

Uber Technologies, Inc. (“UTI”) and Uber BV are joint data controllers for all user personal data in the European Economic Area (“EEA”), Switzerland, and the United Kingdom, and UTI is the sole data controller for all other data. Uber’s PSRT team processes requests from law enforcement worldwide, in accordance with the instructions of the relevant data controller.

Upon receiving legal process, a preservation request, or an emergency disclosure request, Uber may disclose the requested data if doing so would be consistent with:

• U.S. law, including the Electronic Communications Privacy Act;
• local law of the requesting authority, and any other applicable laws, such as the EU’s General Data Protection Regulation (GDPR);
• Uber’s core principles, as described below; and
• Uber’s user policies, including the Privacy Notice and applicable Terms of Use.

Law enforcement should use the Portal as the primary means for contacting the PSRT. The Portal provides the central point of contact for law enforcement to communicate with PSRT specialists when submitting legal process, preservation requests, or emergency disclosure requests. Law enforcement may also use the Portal to obtain status updates on submitted legal process or to ask questions. Instructions for creating an account are available here. Only law enforcement and government personnel authorized to obtain evidence in connection with official legal proceedings may use the Portal. Portal accounts should be created using an official law enforcement or government email account.

Requirements for Legal Process, Preservation Requests, and Emergency Disclosure Requests

When submitting any request to Uber, law enforcement should identify the specific account(s) implicated by the request. When possible, law enforcement should provide a unique identifier associated with the account(s), such as email address, phone number, and/or license plate number. Names alone often are not unique identifiers, nor are dates of birth (to the extent collected). Uber may also be able to identify accounts that are relevant to a law enforcement investigation by searching for information related to a specific trip. For such requests, information about that trip, such as user identification information named above, and a date, time, trip ID, or pick up or drop off location, should be provided.

Legal process, preservation requests, and emergency disclosure requests must be addressed to the appropriate Uber entity:

• Requests from EEA, Swiss, and UK authorities should be addressed to Uber B.V., Burgerweeshuispad 301, 1076 HR, Amsterdam, the Netherlands.
• Requests from all other authorities should be addressed to the Public SafetyResponse Team, Uber Technologies, Inc. (UTI), 1515 3rd Street, San Francisco, CA 94158.

Legal Process

All law enforcement requests for data must be supported by legal process (with the exception of emergency requests, discussed below). Uber reserves the right to reject legal process for any reason, including requests that do not have a valid legal basis, are overbroad, vague, or otherwise inappropriate, or if Uber cannot verify the legitimacy of the request. Uber may also require a valid U.S. court order (via mutual legal assistance treaty, mutual legal assistance agreement, or letter rogatory) to disclose certain types of records to authorities outside the United States. For example, Uber generally requires a valid U.S. court order (via mutual legal assistance treaty, mutual legal assistance agreement, or letter rogatory) in order to disclose the content of communications to authorities outside the United States.

To be valid, legal process submitted to Uber must generally:

• be addressed to the appropriate Uber entity;
• be issued in compliance with the local law of the requesting authority;
• be issued by an appropriate authority, such as a judge;
• be signed by an appropriate authority, such as a judge;
• be dated;
• provide a date to return the responsive materials, if applicable; and
• specifically identify the targeted account(s), reasonably identified; the type(s) of information within the account to be disclosed; and any applicable date range.

Preservation Requests

Law enforcement may seek the preservation of account records. Upon receipt of such a request, Uber may take steps to preserve any records or other information in its possession regarding the subject of the preservation request, pending the issuance of legal process. A preservation is a one-time “snapshot” of the records or content in an Uber user’s account at the time we receive the preservation request; it is not an ongoing, real-time preservation of those records. Uber reserves the right to reject preservation requests for any reason.

Emergency Disclosure Requests

To the extent consistent with U.S. and local law, Uber may voluntarily disclose user data to a law enforcement entity if Uber has a good-faith belief that an emergency involving danger of death or serious physical injury to any person requires disclosure without delay of information related to the emergency. Requested data must be limited to data necessary to specifically address the ongoing emergency.

Emergency disclosure requests may be submitted via the Portal, or via email with an Emergency Disclosure Form attached. Because of its commitment to safety on its platform, Uber has processes in place to respond to emergency requests on a 24/7 basis.

To submit an emergency disclosure request, law enforcement must:

• certify that they are authorized by law to obtain the requested records;
• certify that the request is, in fact, related to an emergency involving danger of death or serious physical injury that requires disclosure without delay of information relating to that emergency;
• state that there is a significant risk that the emergency may materialize if there is a delay caused by obtaining valid local legal process;
• specifically identify the targeted account(s), reasonably identified; the type(s) of information within the account to be disclosed; and any applicable date range; and
• if required by law, follow-up with legal process.

Uber evaluates emergency disclosure requests on a case-by-case basis, including on an exigent basis, and will determine in its sole discretion whether to produce the sought-after data. Uber may request additional information or documentation to aid in its evaluation of an emergency disclosure request.

Uber’s User Notice Policy

Uber may notify users of law enforcement requests for their data, unless notice is prohibited under applicable law.

As part of Uber’s safety investigation procedures, Uber may choose to contact an individual identified in a law enforcement request in connection with any alleged safety incident. Uber will not initiate such contact if it reasonably believes, in its sole discretion, that such contact may:

• pose immediate risk of serious injury or death to a member of the public; or
• pervert the course of justice or prejudice the administration of justice.

When submitting a request, law enforcement may ask that Uber not contact anyone associated with the request due to the foregoing reasons or other valid reasons as the case may be.

Uber’s Core Principles

Uber evaluates requests from law enforcement authorities outside the United States with reference to Uber’s core principles. Uber may not disclose data if doing so would be inconsistent with those principles.

Uber’s core principles for law enforcement requests include:

1. All requests must comply with applicable law, and be appropriately scoped.
2. Uber will not enable real-time and ongoing access to precise and intact trip data by allowing unsupervised access into its internal systems.
3. Requests related to criminal investigations must relate to conduct that would constitute a crime in the United States and the target’s country of residence, except for requests relating to the disclosure of EEA, Switzerland and the United Kingdom user data. In these jurisdictions, the criminal investigation must relate to conduct that would constitute a crime in the Netherlands or the United States, as well as the target’s country of residence.
4. Local law must provide a mechanism for challenging legal process.

Information Available From Uber

This section describes the general categories of user data that may be available from Uber. It is meant to provide a guide regarding some of the most commonly requested data types, and is not meant to be exhaustive. For additional information about Uber products, please see The Uber Product page.

Uber collects and maintains user data in accordance with its Privacy Notice and applicable Terms and Conditions. The data Uber collects and maintains may vary from account to account, such as when an Uber user deletes their account information. Accordingly, the types of data Uber provides in response to valid legal process may vary.

Basic Subscriber Information

Basic subscriber information maintained by Uber for riders and drivers may include:

• name;
• email;
• phone number;
• date of account creation; and
• account status.

Device Information

Device information includes information about the user’s mobile device.

Vehicle Information

Vehicle information that Uber may provide includes:

• license plate data;
• make and model;
• vehicle insurance;
• vehicle registration; and
• vehicle identification number (VIN).

Billing Information

Means and source of payment information that Uber may provide includes:

• partial credit card (first six and last four of the credit card number) or bank account numbers (drivers and deliverers only);
• credit card expiration date;
• associated credit card zip code; and
• other payment instruments.

Other billing information that Uber may provide includes:

• information about particular transactions, like amount, date and time the transaction was made, and the payment instrument used.

Trip Information

Trip information generally includes:

• a breakdown of the amounts charged to the rider for the trip;
• the pick-up and drop-off locations (latitude and longitude); and
• information about the rider(s) and the driver, including the name, and rating. Note that drivers and riders enter their names as seen in app, so they are not necessarily their given names or could be abbreviated (e.g. “Chris” for “Christopher”).

Location Information

Uber may collect GPS location information from the mobile devices of its drivers and riders. A driver’s location information may be captured when the Uber app is running on the driver’s mobile device on or off trip as long as the driver is logged in to receive trips. Riders have the option in their device settings to opt out of the collection of their GPS information, and if they choose to do so, the rider’s GPS will not be captured.

Other User Profile Information

Other user profile information about the user that Uber may provide include:

• rating(s) (one to five stars);
• written feedback/comments; and
• profile photograph(s).

Driver Profile Information

Uber may retain the following information about its driver:

• date of birth;
• vehicle information (as described above); and
• driver’s license number

Communications Information

Uber may capture certain information about communications between its users on the Uber app, such as when a driver and rider use the app to communicate with each other. This may include non-content records associated with such communications, or in the case of text messages through the app, the contents of those communications.

Records of communications may include:

• to/from information; and
• date and time of the communication.

Contents of communications may include messages sent between users on the app.

Customer Service Records

Customer service records Uber may retain include:

• recordings of customer support calls; and
• other customer support communications.

Other Business Records

Other business records Uber may retain include:

• driver’s license copies.

Information Associated with Other Uber Services

Uber may provide other categories of information about users of its other services.

Uber Eats:

• basic subscriber information;
• restaurant information;
• contact information for the restaurant or owner;
• order history; and
• contents of communications between users and Uber Eats deliverers.

Uber Freight:

• call logs between Uber and carrier;
• texts between Uber and carrier;
• carrier contact information;
• load information (e.g., origin, destination, contents of shipment); and
• GPS location information (unlike rideshare, drivers are not required to be logged in during a delivery; therefore, GPS data may or may not be available)

Uber may be able to provide additional data not listed here. Law enforcement requests should clearly detail the data sought, consistent with the guidelines provided above.

Frequently Asked Questions (FAQs)

Q: How do I submit legal process to Uber?

A: Legal process, preservation requests, and/or emergency disclosure requests should be uploaded through Uber’s Public Safety Portal. The Portal helps validate that a requestor is actually authorized to make the request, since they use their department, agency, or government email address to sign up for a Portal account. The Portal helps Uber collect the information it needs to process law enforcement requests quickly and offers helpful functionalities to law enforcement, such as the ability to monitor the status of their request(s) or to communicate with the PSRT.

Q: Do you notify users of legal process?

A: We may. For information about Uber’s user notice policy, see subsection ‘Uber’s User Notice Policy’ in the above guidelines.

Q: What should law enforcement do with the records it obtains from Uber once the investigation or case is over?

A: Information obtained from Uber should be destroyed once the investigation or case has been completed or the data is no longer necessary, whichever is earliest.

Q: I sent in legal process, but I haven’t heard back from Uber. What should I do?

A: Uber’s Portal allows law enforcement to track the status of their request(s) and send follow-up questions. Uber receives thousands of requests each year and triages the requests it receives upon receipt. Uber makes every effort to respond to requests quickly.

Q: What is Uber’s policy for deactivating accounts? Does Uber deactivate accounts upon request? Will Uber keep an account open if requested?

A: Because of its commitment to safety on its platform, when Uber is made aware of an incident, Uber may take actions that include deactivation of the individual from the platform. Please see the Uber Community Guidelines for Uber’s deactivation policies.

Q: Does Uber request reimbursement for the costs associated with responding to legal process?

A: At this time, Uber generally does not seek reimbursement for costs associated with responding to legal process, although it reserves the right to do so.

Q: Can Uber provide the password to a user’s account?

A: No, Uber does not have access to user passwords.