Lime for Business Employer Data Sharing

What it is

The policy states that for Lime for Business users, ride data including trip history is shared with the user's employer for reporting and payment purposes as part of the corporate account arrangement.

Why it matters (compliance & governance perspective)

Users of Lime for Business should expect that their employer will receive detailed ride data, meaning their travel activity is not private from their employer.

Consumer impact (what this means for users)

Under this clause, employees enrolled in Lime for Business should be aware that individual ride records and trip data are shared with their employer, as the agreement states this sharing occurs for reporting and payment processing purposes as part of the corporate account.

Institutional analysis (Compliance & governance intelligence)

1) REGULATORY LANDSCAPE: This provision implicates GDPR and UK GDPR in jurisdictions where employees have data protection rights regarding workplace monitoring and employer access to personal data; Article 88 of GDPR and national implementing measures govern employment-context data processing. It may also engage CCPA provisions for California employees following the expiration of the B2B and employment exemptions. Relevant enforcement authorities include EU supervisory authorities and the California Privacy Protection Agency. 2) GOVERNANCE EXPOSURE: Medium. Employers receiving employee ride data must ensure their own processing of that data complies with applicable employment privacy law, including requirements for notice, proportionality, and legitimate purpose under GDPR. The scope of data shared with employers is described generally as 'information' and 'data about the rides you take' without specifying whether location, timing, frequency, or other granular trip details are included. 3) JURISDICTION FLAGS: EEA and UK jurisdictions create heightened exposure due to employment-specific data protection requirements under GDPR Article 88 and national law. California employees may have rights under CPRA regarding employer access to their personal information processed through third-party platforms. 4) CONTRACT AND VENDOR IMPLICATIONS: Employers participating in Lime for Business should review their agreements with Lime to understand the scope of employee data received, their obligations as data recipients, and whether their own privacy notices to employees adequately disclose this data sharing. HR and legal teams at employer organizations should assess whether use of Lime for Business data for purposes beyond payment processing is permitted under applicable employment law. 5) COMPLIANCE CONSIDERATIONS: Compliance teams at both Lime and participating employers should evaluate whether employees are given adequate notice of the ride data sharing at enrollment, whether the data sharing scope is proportionate to the stated purposes of reporting and payment, and whether data processing agreements between Lime and employers address retention, security, and permitted use of shared ride data.

Applicable agencies

Applicable regulations

Provision details

Other risks in this policy

• Transaction Data Seven Year Retention medium
• Account Information Collection Obligation high
• California Resident Privacy Rights Incorporation high
• Facial Recognition Identity Verification Use high
• Government and Law Enforcement Agency Sharing high
• Government ID Photo Collection Requirement high

Related Analysis

• Meta Removed 438 Sentences From Its Privacy Policy. Here Is What Disappeared.

  ConductAtlas detected a major restructuring of Meta’s privacy policy that removed detailed consumer rights disclosures and relocated them to separate documents.

• 23andMe Is Bankrupt. What Happens to Your DNA Now?

  Your genetic data may be transferred to a new owner as a business asset. Here is what the Terms of Service actually say and what you can do right now.