Uber’s First Chief Privacy Officer on Finding Mindfulness and a Trip to Vegas

Uber was a company in transition when Ruby Zefo began her tenure at the company in August 2018.

The ride-hailing app was recuperating from an embarrassing 2016 data breach incident, where two hackers accessed the names, email addresses and phone numbers of 25 million U.S users and drivers.

Instead of reporting the incident, as required by the law, Uber paid the hackers $100,000 to delete the data. And as a result, the company paid $148 million to settle claims. Former CEO Travis Kalanick was running the company at the time, before stepping down in the middle of 2017 amid a string of accusations about the company’s culture and ethical practices.

A lot was changing within the walls of the San Francisco-based company, especially around its approach to privacy.

“Some companies spend a lot of time thinking about privacy, and some don’t,” said Zefo. “Uber had to learn it the hard way, which is why they hired me pre-IPO to help turn it around.”

Now, Uber is a company with revenues of  $31.8 billion in 2022 and an ads business worth $500 million, which it plans to grow to $1 billion by 2024, per its February earnings. In October, it said it will launch ads before and during a customer’s ride via the app. 

As Uber’s first chief privacy officer, Zefo got her first taste of a privacy-driven role at her previous company, Intel Corporation, in 2011. Following the launch of a consumer-facing set-top box that came complete with a camera so the company could see who was in the room, Zefo was dropped overnight into the role of a legal director for IT, privacy & security.

Inside Uber’s CPO’s day

Currently at Uber, a majority of Zefo’s day involves deciding whether certain data incidents qualify for breach investigations. Along with this, she delegates legal work involving privacy updates and policy-making protocols across her team.

“Every company has minor incidents where you’re wondering what happened with some data,” she told Adweek. “I make the call every day on what incident is a problem.”

At the core of every company’s reputation lies its privacy policies. Uber, being a global company with its base in California, complies with the most conservative privacy policies, Europe’s GDPR and California Consumer Privacy Act.

As the U.S. is headed for a patchwork of statewide privacy laws, tracking the different legislations is hard, Zefo admits. But with the support of her team, she frequently develops and updates the company’s privacy policies.   

“I love the uncertainty, ambiguity, maturity and judgment that comes with this role,” she said.

A trip to Vegas and a journey into mindfulness 

Daughter to a father who belonged to a poor immigrant family from a remote town in Croatia, called Janjevo, Zefo was the youngest of four sisters, whose mother instilled a sense of independence in her daughters.

“She always told us to make sure we could support ourselves without relying on anyone else,” said Zefo, whose mother eventually went to a local college in her 40s, graduated and then got her master’s at 50 before landing her first full-time job as a speech pathologist. 

In the push for independence, Zefo put herself on a “terrible treadmill” for most of her career. But a divorce, a trip to Vegas trip and a journey into mindfulness changed her outlook on life. 

As a mother of two and a cat-parent to two rescued tuxedo cats, Boo and Moo, divorce made Zefo realize that perfection was a myth.

On a Vegas trip with a group of professional women, Zefo watched how these women pampered themselves with massages, pedicures and expensive shoes. She realized she was making all this money but seldom spoilt herself.  

And lastly, an eight-week course in Palo Alto began Zefo’s journey to mindfulness.

“I never really took care of myself until these three things happened,” she said. “The fact that it took me this long [to realize] is shocking.”

The path to privacy, for women and Uber

Zefo is enrolled in Uber’s mentorship program, mentoring women of color.

“When I was a litigator, almost all of my opponents were middle-aged white men who constantly tried to bully me,” Zefo said. “I don’t women to have the same journey that I’ve had.” 

At the time, “[privacy law] didn’t seem very sexy,” she added. “So, women got to do it. And now we’re all here.”

However, privacy is a risky road to navigate, especially for Uber.

The company plans to test ads, based on riders’ trip history, that show up at least three times during their journey, sparking concerns about people’s privacy. 

“Uber is that company where you can see the impact of your work almost immediately,” said Zefo. To mitigate risks, Zefo and her team conduct privacy reviews and suggest relevant mitigations for any potential threats. 

“I want to see examples of those coming to life,” she said. “And that’s why you test these things.”