Deutsche Telekom AG, the Bonn-headquartered, partially state-owned telecommunications group, publishes a group-wide privacy governance framework (its Binding Corporate Rules Privacy) and detailed corporate-ownership disclosures, but its consumer-facing brand Telekom Deutschland GmbH has been the subject of a 2023 German court order concerning cookie-based tracking and undisclosed international data transfers, alongside several disclosed data-security incidents affecting hundreds of thousands of customers across its national subsidiaries. A German court ordered Telekom Deutschland GmbH to stop transmitting consumer personal data to third countries via cookies and similar technologies on telekom.de for analysis and marketing purposes absent an adequacy decision or other GDPR safeguard. The company's own transparency reporting discloses recurring but comparatively small-scale breach and consent-process incidents across its European subsidiaries, which it reports to national data protection authorities as required.
TIMELINE
NO ENTRIES ON FILE YET.
ULTIMATE PARENT
Deutsche Telekom
THIS FILE HEADS ITS OWN CHAIN.
SUBSIDIARIES ON FILE (1)
TOOLS WE RECOMMEND
PLUS
RECEIPTS
8 ON FILE
COLLECTION
Deutsche Telekom's wholesale data-privacy policy discloses that visiting its websites causes the web server to log technical identifiers about each visitor.
Deutsche Telekom discloses a group-wide internal privacy framework (Binding Corporate Rules Privacy, or BCRP) and states it publishes a list of which subsidiary companies are formally bound by it, covering multiple national telecom operating units.
Deutsche Telekom's data-privacy policy discloses that some marketing partners operate independently or as joint controllers and may combine collected data with data from other sources for their own advertising purposes.
The same 2023 Cologne court case also concerned Telekom Deutschland GmbH's disclosure of customers' financial data to credit-reporting agencies SCHUFA Holding AG and CRIF Bürgel to assess creditworthiness in connection with mobile contracts.
Deutsche Telekom's own status report discloses that its Romanian subsidiary, Telekom Romania, was fined by the Romanian Data Protection Authority for inadequate security measures after unauthorized disclosure of data belonging to over 99,000 customers.
The January 2023 Cologne Regional Court order described above constitutes a civil enforcement outcome against Telekom Deutschland GmbH on cookie consent and international transfer practices, obtained by a consumer-protection body rather than a data protection regulator.
Deutsche Telekom's privacy disclosures state that use of its digital services results in creation of a behavioral advertising profile used for cross-service ad targeting.
In January 2023, the Cologne Regional Court (Landgericht Köln) ordered Telekom Deutschland GmbH, following a suit by a North Rhine-Westphalia consumer protection group, to stop transferring consumer data collected via cookies and similar technologies on telekom.de to third countries for analytics and marketing purposes without a valid GDPR transfer basis, and found the consumer group had alleged the company's cookie banners relied on dark patterns.