Dear Careem, Stop Sharing Riders’ Personal Information with Drivers

News Abed Kataya Careem, Digital Rights, Lebanon, MENA region, Privacy, Right To Privacy April 25, 2019 October 8, 2019

It was recently revealed that Careem, the Emirati-based ride hailing company, recently purchased by Uber, routinely shares riders’ full names and phone numbers with drivers, or “captains” as the company refers to them. This policy has resulted in drivers sending unsolicited Facebook friend requests to riders, violating their privacy and potentially threatening their safety.

On April 21, Alexandra Tohme, a Careem user, asked a representative of the company over twitter to confirm if it shares riders’ phone numbers and full names with drivers. Tohme shared a screenshot of an email exchange with Careem, where the company informed her that: “[it provides] both the customer and the captain with the other’s phone number during the ride as it makes it easier for them to reach out to each other and coordinate.”

Tohme told SMEX that it had not been the first time a driver contacted her directly on her personal phone. Other Careem users replied to Tohme’s tweet claiming that they too had experienced similar calls to their personal phones. After the first incident, Tohme decided to contact the company via email to ask about this issue. The company responded that “this shouldn’t happen,” which directly contradicts the email she received after her most recent trip.

Careem, which operates in the Middle East and North Africa (MENA) and South Asia regions, appears oblivious to the implications and risks of sharing users’ personal data, even going as far as to deny that a phone number constitutes personally identifiable information (PII). In response to Tohme’s tweet, the company replied: “While we don’t share passengers’ personal information with Captains, we do provide both the Customer and the Captain each other’s phone numbers to make it easier for them to coordinate for the upcoming trip.” The company did not offer a reason for providing drivers with riders’ full names.

Like its parent company Uber, Careem confirmed it does offer anonymized calling, or “call masking,” in some countries where it operates, which poses a significant privacy threat to users. Despite this claim, Tohme noticed an inconsistency in this policy; when waiting for a Careem driver she “received a call from his personal mobile number (76)… followed by a call from 04 [UAE] number.” Therefore, even in countries where Careem operates with “call-masking” and may route some of these calls through company call centers, it still provides drivers with riders’ phone numbers as said in its privacy policy. Giving out riders’ numbers to drivers renders the purpose of the call center useless and fails to protect user privacy.

While Uber does not give riders’ phone numbers directly to drivers in certain regions, it is yet to introduce an in-app calling feature in Lebanon. Last year, SMEX wrote about Uber’s lack of an anonymized calling feature, which makes it possible for drivers and riders to discover each other’s phone numbers. In several cases, access to users’ personal information enabled drivers to harass or threaten their past riders for reporting them or giving them a bad rating.

Uber’s recent purchase of Careem will likely have a negative impact on customer privacy. Uber’s regional monopoly not only “[allows] it to control the overall supply of services in the region,” but the company’s only incentive to improve privacy policies will come from consumers. Uber’s reluctance to introduce some form of in-app anonymized calling is especially indefensible considering that its subsidiary does in fact operate existing call centers in the region. Unfortunately, Uber’s acquisition of Careem may give the company fewer reasons to improve these services.

Uber and Careem need to abandon a growth-at-all-cost mentality and develop privacy policies for countries in the MENA and South Asia regions with the same level of concern they apply for countries in the Global North, while taking into account local contexts.

We recommend that Uber and Careem adopt the following policies:
– Stop sharing personal information, including full names and phone numbers, with drivers.
– Introduce anonymized phone numbers or develop other anonymized in-app communication methods.
– If the cloud technology is too costly, Careem should introduce call centres in Lebanon and all other markets and re-route calls through a local Careem call center.

We would also like to reshare some tips to protect yourselves until Careem and Uber introduce call masking in Lebanon:

– Do not call the Careem or Uber drivers using the in-app calling feature; if you must get in touch, use the in-app messaging feature instead.

– Try to avoid giving a driver the exact pickup or destination address especially if it is a private residence, workplace, or frequent destination.

This page is available in a different language العربية (Arabic) هذه الصفحة متوفرة بلغة مختلفة

Avatar photo

Abed Kataya

Digital Content Manager at SMEX. Digital safety trainer and freelance journalist. Interested in technology, economics and entrepreneurship. Follow him on Twitter @kataya_abd.