1&1 Telecom GmbH

€9.6M($10.3M USD)final

Date Issued

2019-12-09

Regulation

Authority

The Federal Commissioner for Data Protection and Freedom of Information (BfDI)

Country

Germany

Violation Type

Failure to implement sufficient measures to ensure information security

Currency

EUR

Violation Summary

The telecom company 1&1 Telecom GmbH was fined with €9,550,000 after it came to light that sensitive customer information could be obtained by phone by anyone by just telling a client’s name and date of birth. This could have permitted anyone to obtain the personal information of any customer in case they knew their name and date of birth. The BfDI considered that the company failed to implement the necessary technical measures to ensure the protection of personal data. The BfDI further revealed that the fine was intended to be much larger but was eventually decreased due to the cooperation of the company during the investigation.

Articles Violated

Art. 32 GDPR

Other Fines for 1&1 Telecom GmbH

DateRegulationAmount (USD)Type
2020-11-11GDPR$972,000Failure to implement sufficient measures to ensure information security
2019-12-09GDPR$10,314,000Failure to implement sufficient measures to ensure information security