The Information Commissioner's Office (ICO) outlined its views on the operation of 'bug bounty' programmes in a new monetary penalty notice it has served on Uber.

https://www.out-law.com/en/articles/2018/november/uber-fined-uk-netherlands-data-breach/