German authorities have serious indications of possible data protection violations by Tesla, the Handelsblatt reported on Thursday, citing the data protection authority of the federal state in which the carmaker operates its European gigafactory.
The Handelsblatt report said the US electric car maker had failed to adequately protect the data of customers, employees and business partners, citing 100 gigabytes of confidential data leaked to the newspaper by a whistleblower.
The data protection supervisory authority in the Netherlands, where Tesla’s European headquarters are located, has been informed of the case, the newspaper said, adding that Tesla had also submitted a preliminary notification to the Dutch authorities on the matter.
The European Union’s General Data Protection Regulation (GDPR) requires companies to do so if they fear that personal data may have been lost.
The Brandenburg data protection office was initially unavailable for comment.
Tesla was not immediately available for comment on the report.
Handelsblatt said the data set, dubbed the “Tesla files,” contained customer data “in abundance.”
The files contain tables of more than 100,000 names of former and current employees, including Tesla CEO Elon Musk’s social security number, personal email addresses, phone numbers, employee salaries, customer bank details, and secret manufacturing details.
The breach would violate the GDPR, the newspaper added.
Handelsblatt quoted a Tesla lawyer as saying a “disgruntled ex-employee” misused his access as a service technician to obtain information, adding that the company will take legal action against the alleged ex-employee.
According to the newspaper, the whistleblower informed the German authorities about the data protection breach in April.
From a data protection point of view, the matter would become serious if the evidence became valid, a spokesman for the Brandenburg data protection office told the Handelsblatt.
Citing the leaked files, the newspaper reported thousands of customer complaints about the carmaker’s driver assistance systems, including around 4,000 complaints about sudden acceleration or phantom braking.
Last month, a Reuters report showed that groups of Tesla employees privately shared videos and images, some highly invasive, taken by customers’ dashcams between 2019 and 2022 via an internal messaging system.
This week, Facebook parent Meta was fined a record €1.2 billion ($1.3 billion or around Rs. 9,606 billion) by the European Union’s top data protection regulator for handling user information, and given five months in court to stop sending user data to Facebook US.
© Thomson Reuters 2023
