Brazil’s competition authority has asked the data protection agency to clarify privacy requirements for third-party tools processing passenger information displayed to Uber drivers.
Brazil’s competition authority has requested information from the National Data Protection Agency (ANPD) as part of an administrative inquiry into Uber’s restrictions on the StopClub app.
The Administrative Council for Economic Defense (CADE) asked the ANPD to assess the processing of personal data by StopClub’s tools that operate on drivers’ devices and that use information displayed by Uber when offering a trip.
The questions go to one of the central points of disagreement in the inquiry. Uber has cited passenger privacy and data security as justifications for restricting two StopClub functionalities, while StopClub argues that its tools process locally information already shown to drivers and do not access Uber’s internal systems.
The query was sent by Councilor Camila Cabral Pires Alves, who is leading the inquiry following the Tribunal decision to reopen the investigation for further examination of Uber’s justifications.
StopClub filed its complaint against Uber on Nov. 4, 2024, alleging that the ride-hailing company had adopted measures intended to restrict tools offered to app-based drivers.
According to StopClub, its functionalities operate independently on the driver’s device, without technical integration with Uber’s internal systems or the use of application programming interfaces (APIs) provided by the platform.
Its Earnings Calculation tool uses the price, estimated distance and duration of a trip to calculate expected earnings per kilometer and hour. Drivers can supplement the calculation with their own estimates for fuel, vehicle maintenance, rental costs and other operating expenses.
StopClub also said any passenger information used by its tools is already displayed to the driver by Uber, including the passenger’s first name, pickup and destination addresses, and rating. According to the company, the processing occurs on the driver’s device, without external transmission or storage.
Uber disputes that characterization. It argues that StopClub accesses passenger data “without the users' knowledge or authoritzation” and that the information is made available to enable ride-hailing services, rather than for processing by third parties for separate purposes.
Uber has also said its privacy protections could become ineffective if third parties capture information temporarily displayed to drivers.
Questions to ANPD
CADE asked the ANPD which conditions a tool must satisfy under the General Personal Data Protection Law (Lei Geral de Proteção de Dados, LGPD) when it operates on a driver’s device and processes information already presented by a ride-hailing platform for the evaluation of a trip offer.
It also asked which precautions or safeguards are appropriate when a tool used by the driver processes information already disclosed in connection with the offer.
A further question concerns which technical and organizational safeguards could mitigate potential personal-data risks associated with such tools, particularly under the LGPD principles of adequacy, necessity and security.
CADE also asked whether a platform’s terms of use need to restrict third-party data processing beyond the limitations already established by the LGPD and, if so, under which circumstances those additional restrictions would be justified.
Source: MLex
