Deutsche Telekom presents comprehensive package of measures for data privacy

Deutsche Telekom intends to significantly improve data privacy in the interest of its customers by taking immediate action. In addition to increasing transparency and optimizing data privacy standards, the Group, by setting up a Data Privacy Board department, intends to send out a clear signal in terms of the significance of data protection in today’s information society. The following are the key issues presented by CEO René Obermann: a voluntary commitment to reporting critical data privacy incidents, a data privacy report and an independent privacy council in order to ensure more transparency.

"We want to provide maximum security for the data of our customers", explained Mr. Obermann. "In the race against data theft, we want to be at least one step ahead at all times. To achieve this, we have to regularly upgrade our systems and structures, demand that people assume responsibility and hold managers accountable where there are shortcomings." Additional data privacy certification of customer systems as well as improved technology and processes are to increase operational data protection.

To this end, data privacy, legal affairs and compliance are to be combined and significantly reinforced as one area of responsibility. For this reason, the Board of Management will propose to the Supervisory Board the creation of a seventh Board department for these areas. This will entail an increase in financial and human resources as well as a right to veto all business decisions related to customer data. "The new Board department is to ensure that the necessary steps for safeguarding data privacy are decided centrally and implemented throughout the Group", emphasized Mr. Obermann.

Comprehensive data privacy initiative for optimizing data security In addition, Deutsche Telekom is launching major initiatives to increase customer data security throughout the Group.

"In the past few months, we have developed a comprehensive set of measures which we will now implement to immediately improve data privacy", said Timotheus Höttges, Board of Management member responsible for Sales and Service, as well as Security.

The following steps will be taken to improve transparency:

• Beginning next week, Deutsche Telekom will provide online information about data protection incidents undergoing criminal investigation. Thus, Deutsche Telekom will take the lead in meeting the obligation to furnish information, a subject which is still being debated at the political level.
• A yearly data privacy report will be launched and supplemented by a half-yearly interim report. The first report is scheduled to be published in the first quarter of 2009.
• In the future, Deutsche Telekom will voluntarily have its customer systems certified by independent providers (such as TÜV IT). In addition, independent security companies will be asked to systematically analyze the systems and search for weak spots.
• The setting up of an independent data privacy council comprising leading experts from supervisory bodies and independent organizations will ensure a critical dialog with renowned experts.

For operational data privacy, comprehensive measures will be launched and followed up:

• Responsibilities in customer care will be defined more strictly and access to data decreased. Data access will be systematically logged and administrators more monitored. Access of external sales partners and our staff to our systems will be restricted. Currently, PIN/TANs are being introduced for accessing sensitive databases in order to prevent unauthorized access from external processors to our systems.
• An "expiry date" for user IDs is being introduced so that user IDs regularly expire and have to be renewed. In addition, the use of fixed IP addresses is being increased so that employees and sales partners may access the systems only from specific computers.
• The widespread introduction of terminal systems will prevent decentralized storage of customer data.
• In order to protect the data of particularly vulnerable individuals there are plans to develop a concept in cooperation with the Federal Criminal Police Office and the police.

"We are not aiming for a program that will be completed in three to five years. Rather we are establishing a new fundamental and permanent approach to data privacy", says René Obermann.