German telecoms firm slapped with €10m GDPR fine

People could access sensitive customer data in some cases by only providing a name and date of birth

GDPR readiness

The German data regulator has fined the telecoms giant 1&1 almost €10 million for not taking sufficient measures to prevent unauthorised access to customer data.

The company has been punished because it failed to take measures to adequately protect the data of its customers, meaning extensive customer information could be accessed by just providing the name and date of birth. 

The lack of protections for customer data constituted a violation of Article 32 of the General Data Protection Regulation (GDPR), according to the Federal Commissioner for Data Protection and Freedom of Information (BfDI).

The Federal Commissioner Ulrich Kelber explained the €9,550,000 fine was a clear sign the data regulator would enforce the protection of fundamental rights under GDPR, and that due consideration was taken in the decision.

Advertisement
Advertisement - Article continues below
Advertisement - Article continues below

Despite the severity of the fine, BfDI also noted that 1&1 was transparent and cooperative during the investigation. 

To rectify its processes, the telecoms giant first introduced new authentication steps, before unveiling plans to roll out an authentication procedure with significantly stronger barriers to accessing data.

The BfDI said the fine could have been much higher had 1&1 representatives not been as cooperative as they were during the investigation. The infringement, moreover, was limited to just a handful of customers, despite all customers being at risk. 

Related Resource

Understanding the must-haves of modern data protection

Go beyond traditional backup and recovery

Download now

The data regulator added it would be investigating the customer authentication procedures of rival telecoms companies as a result of its findings. 

The agency has been active in recent months, having previously issued a €14.5 million fine against a housing giant for hanging onto the personal and financial data of former and current tenants longer than necessary.

The fines have been adding up since GDPR came into effect in May 2018, but are blown out of the water when compared with the multi-million-pound penalties issued against the likes of BA and Marriot.

  • compliance
  • General Data Protection Regulation (GDPR)
Featured Resources

How inkjet can transform your business

Get more out of your business by investing in the right printing technology

Download now

Journey to a modern workplace with Office 365: which tools and when?

A guide to how Office 365 builds a modern workplace

Download now

Modernise and transform your sales organisation

Learn how a modernised sales process can drive your business

Download now

Your guide to managing cloud transformation risk

Realise the benefits. Mitigate the risks

Download now
Advertisement

Most Popular

Visit/mobile/28299/how-to-use-chromecast-without-wi-fi
Mobile

How to use Chromecast without Wi-Fi

5 Feb 2020
Visit/technology/artificial-intelligence-ai/354796/ai-identifies-11-earth-bound-asteroids
artificial intelligence (AI)

AI identifies 11 earth-bound asteroids

18 Feb 2020
Visit/business/business-operations/354790/hp-shareholders-invited-to-come-dine-with-xerox
Business operations

HP shareholders invited to come dine with Xerox

17 Feb 2020
Visit/operating-systems/27717/how-to-fix-a-stuck-windows-10-update
operating systems

How to fix a stuck Windows 10 update

12 Feb 2020