"Uber waited more than five months to notify drivers whose names and drivers-license numbers were taken in a computer-security breach last year, much longer than allowed by many state laws.
In California, Uber’s home state, the law requires companies who lose consumer names and another piece of personal information, including a driver’s license number, to tell those affected "in the most expedient time possible and without unreasonable delay."
Most state laws covering breach notification use similarly vague time limits. Among states that offer specific guidelines, none is longer than 60 days.
Uber said more than 20,000 of the affected drivers were in California, but declined to specify any other states affected. The company has notified the California attorney general of the breach."
"Unless they were cooperating with law enforcement, which is a possibility, it would seem to be an unusual delay," said Brian Finch.
Source: http://blogs.wsj.com/digits/2015/02/27/uber-breach-exposes-50000-driver-names-and-license-numbers/
