Data Privacy Status Report

The Greek data protection authority imposed a total fine of €9.25 million on OTE and COSMOTE. The fine followed a hacker attack in September 2020 and the supervisory authority's related investigation. The investigation identified, among other issues, a breach of security of processing, insufficient implementation of the data protection impact assessment, and insufficient compliance with information obligations. Once the vulnerability became known, appropriate protective measures were taken immediately to prevent it from happening again. In the same case, the Greek telecommunications authority imposed an additional fine of €3.2 million on COSMOTE.

The Slovak data protection authority imposed a total fine of €40,000 on Slovak Telekom. The reasons included violations of principles governing the processing of personal data and its lawfulness, as well as insufficient fulfillment of the obligation to inform data subjects before processing their data. This led to the unauthorized use of employee data from an internal project involving Slovak Telekom and T-Mobile Czech Republic. Once the vulnerability became known, measures were taken immediately to prevent it from recurring.

The Romanian data protection authority (DPA) imposed a total fine of €13,000 on Telekom Romania. The reason was inadequate implementation of security measures to ensure the security of personal data processing. This led to the unauthorized disclosure of data belonging to 99,210 customers, including their customer number, gender, and phone number, as well as unauthorized access to personal data stored in the accounts of 413 customers. Telekom Romania implemented remedial measures immediately.

A programming error occurred in a specific online booking process for the MagentaEins plan: contrary to the instructions of Telekom Deutschland GmbH (TDG), the service provider implementing the process configured it so that customers could not book the plan without giving consent to advertising (KEK). This constitutes an impermissible tying arrangement. 

Once the error became known, it was corrected immediately, and the consents generated unlawfully in this way were promptly deleted from the system. In the future, compliance with TDG's instructions during implementation by the service provider will be reviewed and documented under the dual-control principle.

Once the incident became known, it was reported to the BfDI as a data protection violation.

As part of a product campaign for "StreamOn", Telekom Deutschland GmbH also sent promotional text messages to customers who had not given Telekom Deutschland GmbH the relevant consent to receive advertising. Around 650,000 customers were affected in total. The incorrect messages were sent because of a technical error in the processing system. 

After identifying the error, we promptly established new review procedures during the campaign that prevent this situation from recurring. We were able to correct the second wave of messages accordingly, so no further incorrect promotional messages were sent. We are already in contact with the responsible supervisory authority (BfDI) about this matter.

Following an application error, credentials for a system at T-Systems appeared on a public developer platform. As a result, an unknown individual gained access to a so-called ticketing system and copied the email addresses and phone numbers of internal developers and approximately 40 users. The ticketing system enables developers to process error reports (tickets) as part of a T-Systems cloud service. 

Our technicians closed the compromised interface immediately after discovering it. According to the ongoing analysis, service tickets were copied that, in some cases, also mentioned the email addresses and phone numbers of users who had reported errors.

We have since identified the unknown attacker. Further investigations have shown that the data copied by the attacker was not shared. All copied data has since been effectively deleted. 

Customer systems themselves were not affected. 

T-Systems has involved the relevant data protection authorities. We will inform affected users without delay.

A customer had data transferred from their old device to another device at the Telekom Shop Schwentinental. This data transfer took place using a USB drive, which was given to the customer. The customer found that, in addition to their own data, the USB drive also contained data belonging to other people. According to a press report, this included private photos, names, and phone numbers of seven other people.

Data protection is our highest priority. We are currently reviewing the incident and are in contact with the responsible supervisory authority (BfDI). The prescribed process requires data transfers requested by customers from one device to another to be carried out using new, unused USB drives that the customer purchases. This ensures that no third-party data is stored on the drive. We are currently reviewing why this standard process was not followed at the Telekom Shop Schwentinental.

If you arranged for a backup of your device at the Telekom Shop Schwentinental on any of the following dates, you may be affected by the data protection incident: June 10, June 23, August 1, August 8, August 24, or September 10, 2018. Please contact us at datenschutz@telekom.de.

Due to an error in the billing process, approximately 4,600 customer invoices were sent incorrectly in mid-May 2017. The affected customers are being informed, and the error has been corrected.

In December 2016, MMS, a T-Systems subsidiary, migrated approximately 2,300 Cloud Manager customers to the latest system version. In one case, a technical error occurred during the migration: One step in migrating the customer mailbox took an unusually long time. Due to a simultaneous temporary technical error, the affected customer was able to access their mailbox during the migration process. At that point, the mailbox access permissions had not yet been fully applied, and the user gained elevated read permissions. This gave the user access to contact information stored on the server by other customers, such as phone numbers, email addresses, and, in some cases, postal addresses. Sensitive information such as banking details or passwords is not stored in this database. As soon as we became aware of the case, Telekom implemented technical safeguards to prevent such an error from occurring again in the future. Once we became aware of the case, we informed the supervisory authority and the customers whose data could be viewed. We asked the customers affected by the error to securely delete the unlawfully obtained data and confirm this to us.

Further investigations have shown that another error likely occurred during the transition, although it presents differently from the current issue. We cannot rule out that up to 36 customers were able to view other customers' data. Here too, this involves only contact information such as phone numbers and email addresses.

In October 2016, a member of the German Bundestag canceled their service and asked us to send the confirmation and final bill to a new address. Previously, their bills had been sent to a central logistics office of the Bundestag. This office is also listed as the billing address for many other members. Unfortunately, due to an administrative error, the new address of the Bundestag member was also entered for other account holders whose billing address was the logistics office. We have since corrected the error; so far, we have identified 35 cases in which bills were sent to the wrong address. The information on these bills includes the bill amount, services provided (such as landline and mobile calling minutes and, where applicable, leased devices), and the address, but not an itemized call record showing the specific phone numbers dialed (those are sent directly to the Bundestag members, if at all). We have informed those affected and deeply regret this oversight.

Telekom gives customers the option to object to the anonymization and transmission of three types of information (age group, gender, and ZIP code) to Motionlogic GmbH (opt-out service). At the end of September 2016, a customer report brought to our attention that an unsecured page was active alongside the secure opt-out page (identifiable by https). Telekom immediately took the unsecured page offline. On the page, customers enter their name and mobile number to receive a code that prevents anonymization and sharing.

Due to a technical error, the RCS/Message+ group chat malfunctioned on May 20, 2016. New participants were automatically added to existing chat groups without an invitation and could not be removed. Once Telekom became aware of the error, it disabled the RCS/Message+ group chat feature and is working to resolve the issue. We reported the incident to the supervisory authorities. Telekom is working to identify and inform the affected customers.

In April 2016, Telekom customers were notified in writing about an increase in the data allowance for MagentaMobil plans. Due to a manual processing error, the personalized letters and envelopes for approximately 50 customers were incorrectly combined. As a result, information about names and mobile phone numbers reached the wrong recipients. Deutsche Telekom notified the affected customers and supervisory authorities about the processing error.

• The Kundencenter app lets Telekom customers manage their mobile and landline services on the go. On March 29, 2016, when the latest app version for iOS devices (version 5.3.6) was released in the App Store, cases became known in which users were shown incorrect data. Based on what is currently known, only one person's data was displayed. Telekom initially removed the app from the App Store and re-released the previous version on April 6. Android device owners can continue using the Kundencenter app as before.
• Between March 24 and March 31, 2016, a technical issue occurred when signing in to services and portals via the so-called Telekom Login. During this period, customers who signed in using an external email address (not t-online.de) occasionally had access to other customers' data. As a precaution, Telekom temporarily blocked the affected Telekom Logins. Affected customers are asked to contact us by 06/30/2016 at 0800 304006. After this date, the accounts will be automatically cleared. Telekom has informed the supervisory authorities.

• During an audit of a call center partner in December 2015, we discovered, among other things, that the partner had engaged an unauthorized subcontractor and provided it with customer data. This constitutes a serious violation of the data processing agreement. Telekom therefore terminated its contract with the call center without notice.
• In March 2015, the "Daten- und Informationsschutz" training program launched for all employees of Deutsche Telekom Group. The online training explains what is legally permitted and what requirements must be met. It is updated every two years and is mandatory for all employees in Germany. A key focus is the Binding Corporate Rules Privacy, the most important internal data protection policy. It also provides helpful tips on handling sensitive information and documents appropriately. The training ensures consistent data protection standards worldwide when processing customer and employee data within the Deutsche Telekom Group.
• Due to a technical error in the online customer service portal for service issues, a single customer gained unauthorized access to another customer's data in early July 2014. The former had access to information such as the phone number and service issue details. Other sensitive data, such as passwords, bank details, and payment information, were not affected. Deutsche Telekom immediately took technical measures to prevent this or similar errors from occurring again in the future.
• In May 2014, an email was sent to an incorrect customer email address due to human error. The email attachment contained reports on another customer's mobile service contracts. Deutsche Telekom informed the affected customers about the incident and adjusted its processes for sending reports.
• An employee report identified an error in the Telekom mobile services portal involving the assignment of contracts to online accounts (login accounts). Under certain circumstances, this error may have allowed customers to view another customer's contract data. To rule out any cases of unauthorized access with certainty, we took the affected parts of the mobile online customer portal offline for several hours on 04/25/2014 and restored them only after verifying that the issue had been resolved.
• A customer report identified a technical error in a link in the online sales portal for business customers. This error could have caused customers entering into a new customer contract to be shown the contract documents of another business customer. The information affected included companies' bank account details and the personal data of company owners, such as their dates of birth and ID numbers.
  
  The error occurred only under certain conditions and affected only customers who retrieved their order confirmation through a link rather than using the correct confirmation sent by email at the same time. As a result, it is not possible to determine how many customers were actually affected. As a precaution, Deutsche Telekom is writing to all 2,107 people who may have been affected. Telekom also notified the supervisory authorities.
• Incorrect access credentials for a business customer administration portal: During a system migration, Telekom accidentally sent an incorrect activation link by email to around 120 business customers. As a precaution, the platform through which users manage internet domains was briefly taken offline until the error was resolved. Telekom is informing the affected customers.
  
  Twenty-eight users of the new administration portal did use the incorrect activation link. In the other cases, it was not used. The error was noticed within a few hours, after which Telekom temporarily blocked the platform to prevent misuse. No harm occurred. The data error was identified and resolved immediately. The cause was email addresses incorrectly assigned due to a system error. Before the system migration, Telekom had asked portal users to provide or verify their email addresses to ensure that only authorized users receive the activation email. However, during the required transfer of email addresses, data was mixed up due to a system error in the data export.
• While preparing to migrate an IT system, we discovered that, rather than containing only anonymized data, it also included employees’ personal information. We stopped the system and informed the works council. We informed the employees on 08/26/2013.
• In June 2013, customer orders were attached to hardware packaging in the retail area of a Telekom Partner Shop to reserve the items for customers. We promptly corrected the processing error and retrained the partners on data protection.
• In mid-November 2012, due to a processing error, a retail sales partner sent several original customer orders and order confirmations to a single customer.
• An SQL CREATE script was published on a website that included internal contact information (name, department, company, telephone number) for Telekom employees. Once discovered, the data was promptly deleted.
• In early May 2012, Telekom discovered that one of its online applicant portals had a security vulnerability. By exploiting this vulnerability, an unknown attacker was able to download applicant documents, such as résumés, certificates, and cover letters, from the relevant application via the internet. The vulnerability was closed immediately after it became known, so the risk of further applicant information being lost can be ruled out. Similar applications are also currently being reviewed. The State Commissioner for Data Protection in North Rhine-Westphalia was informed, and Deutsche Telekom filed a criminal complaint. Those affected were also notified.
• Due to a technical error in the online customer center for fixed-line services, in early February 2012, one customer gained unauthorized access to another customer's data. The customer was able to access information such as the customer's address and contact details, as well as their most recent phone bill, including itemized call records. Other sensitive data, such as any passwords, bank details, and payment information, were not affected. Deutsche Telekom immediately took technical measures to prevent this or a similar error from occurring again in the future. We contacted the customer who had unauthorized access in writing and asked them to delete the information they were not entitled to and confirm this to Deutsche Telekom in writing.
• An unauthorized external party accessed ImmobilienScout24's company servers. The affected information includes address and contact details, customer numbers, and names of both commercial and private providers. This information is generally displayed by default on the ImmobilienScout24 website because it contains the providers' contact details needed when listing real estate. Information from contact forms was also affected, including, for example, catalog requests and requests for information.
  
  No passwords, bank details, or financial information were stolen. ImmobilienScout24, a Deutsche Telekom subsidiary, immediately blocked the access route in question and restored the security of the affected servers. Providers and users were informed. The company filed a criminal complaint against unknown persons with the Berlin Public Prosecutor's Office.
• Technical testing has shown that the Speedport W723V WLAN Router currently sold by Deutsche Telekom is not configured securely enough by default. With some technical effort, it is possible to determine the so-called WPA key and use it to gain unauthorized access to a WLAN network. After the test results became known and following its own testing, Deutsche Telekom published customer guidance on its websites telekom.com and telekom.de advising customers to change the factory-configured WLAN passwords on all Routers. At the same time, it is preparing customer information to be included with all newly delivered Routers in the affected series. Deutsche Telekom immediately contacted the Router manufacturer and launched a process that will ensure the devices are once again securely preconfigured at the factory in the future.
• From 04/14/2011 to 05/10/2011, six emails containing documents relating to three customers who are pursuing payment claims against Telekom Deutschland GmbH in court were sent to an incorrect email address due to an employee error. The emails included copies of the disputed invoices, mobile service contracts, and bank statements as attachments. The invoices contained addresses, customer numbers, and bank details. As soon as the company became aware of the error, it asked the unintended recipient to delete the emails that were not intended for them. Deutsche Telekom is informing the affected customers about the incident and contacting them about the possible assignment of a new customer number.
• In mid-August 2010, a data stick containing financial information about Deutsche Telekom's British subsidiaries was lost while being transported to Germany. The data on the stick is encrypted. No customer data is affected.