Although South Dakota is the only state in the nation without the services of Uber, it still managed to win a half-million dollar share of a $148 million judgment against the ride-sharing service over a data breach.
In a settlement that Uber agreed to last month with all 50 states and the District of Columbia, a state official said Wednesday that South Dakota will receive $573,488 — and the state has approximately 70 Uber drivers to thank for the windfall.
"First of all, South Dakota citizens are using Uber, so we have to protect our citizens," Assistant Attorney General Phil Carlson said of the seemingly incongruous result of a state winning a lawsuit against a company not yet operating within its borders. "Additionally, the data from Uber showed that we had about 71 drivers with South Dakota addresses whose information was compromised."
In a pleading filed in Hughes County, details of the data hack and the ride service's lagging response were laid out.
In November 2017, Uber's new CEO, Dara Khosrowshahi, announced that in 2016 hackers had obtained data of 600,000 drivers, including information from their driver's licenses. Uber tracked down the hackers, paid a ransom and destroyed the information. But states filed suit, anyway, saying the ride-sharing company was required by law to report such breaches.
According to South Dakota law, identity hacks need to be reported within 60 days to the state. So on Sept. 26, the same day the $148-million settlement was made public, South Dakota joined the multi-party suit.
"We didn't organize it (the lawsuit). We weren't a part of the group that was running the investigation," Carlson said. "We were merely a participating member."
The state sought $2,000 per deceptive act — arguing Uber's data protection wasn't as strong as it was made out to be — and $10,000 per day that Uber failed to notify the public about the breach. Before the close of business that same day, Sept. 26, Hughes County Judge Patricia DeVaney entered the settlement as her final judgment.
"Plaintiff and Uber have agreed to the Court's entry of this final judgment and consent decree without trial or adjudication of any issue of fact or law and without admission of any facts alleged or liability of any kind," DeVaney wrote.
The order includes not just a monetary award but further security steps Uber needs to take to ensure privacy protection for drivers and riders, including complying with South Dakota's laws, better protection of user data the company stores on third-party platforms, and the hiring of an outside security consultant.
Carlson said another reason prompting the state's intervention is that Uber "may come to our state at some time in the future." Currently, Uber's competitor — Lyft — operates in Rapid City, Pierre, Aberdeen and Sioux Falls. Uber has been cleared for operation in the state, but has not yet entered the Rushmore State.
"Of course, we want to be able to serve riders all across the country," Charity Jackson, a spokeswoman for Uber, said Wednesday. "Our goal is to be in South Dakota."
Jackson declined to elaborate on why Uber has not entered the state's marketplace, saying that was a question for its attorneys.
A spokesman for Rapid City confirmed that ride-sharing licenses can be applied for thanks to a resolution passed by the city council in 2017.
The $573,488.83 judgment awarded to South Dakota is earmarked for the Office of the State's Attorney General. Carlson said the state's portion of the settlement is commensurate with Uber's civil penalties under state statute.
The state's share will go to fund consumer protection efforts within the Attorney General's Office, Carlson said. Some states announced they would share their portion of the settlement with eligible Uber drivers. Ohio, for example, planned to disperse $1.2 million of its $5.6 million share with Uber drivers in $100 payments.