The ride-hailing company should have done more to protect user data, say UK data regulators.