Here's the new policy, straight from Uber's blog:
We wanted to take a moment to make very clear our policy on data privacy, which is fundamental to our commitment to both riders and drivers. Uber has a strict policy prohibiting all employees at every level from accessing a rider or driver's data. The only exception to this policy is for a limited set of legitimate business purposes. Our policy has been communicated to all employees and contractors.
Actually, let's just stop reading right there. Because considering what Uber has already revealed to be "legitimate business purposes" I would say that anything which follows that line is completely negated. It's pretty clear Uber is going to continue doing whatever the hell it wants. [Uber]