1&1 call centers took a name and birthday as ID — €9.55M GDPR fine, cut to €900K

In 2018, a woman called the customer hotline of 1&1 Telecom GmbH, gave her ex-husband's name and date of birth — and the call-center agent read out his new mobile number. That was not a one-off lapse: the Federal Commissioner for Data Protection (BfDI) found that, in the usual case, 1&1's call centers accepted a name and birthdate as sufficient identification, even when it was apparent that a third party was calling for the customer.

On 9 December 2019 the BfDI, the federal supervisor of telecom data protection, fined 1&1 €9.55 million under Article 32 GDPR. The amount came from the German regulators' fine formula tied to group revenue, sat at the low end of the range because 1&1 cooperated, and reflected a weakness the BfDI rated as touching the entire customer base. 1&1 refused to pay, calling the fine disproportionate — the trigger was a single 2018 inquiry and name-and-birthdate checks were industry standard — and announced it would sue. Days later it shipped a five-digit service PIN, mandatory from 16 December 2019.

The Bonn regional court (LG Bonn, 29 OWi 1/20, 11 November 2020) — the first German judgment on a GDPR million-euro fine — confirmed the violation: 1&1's call centers routinely let a name and birthdate stand as authentication. But it cut the fine to €900,000: a minor breach with no mass disclosure, a practice never previously criticized by any regulator, and no binding legal standard for call-center authentication. The court also ruled that a company can be fined without proving a manager personally erred.

€9.55M fine from the BfDI — Germany's second GDPR million-euro fine; a court cut it to €900,000 in the country's first judgment on a GDPR fine

The authentication secret was data an attacker already has: name and date of birth are public, guessable, or known to every stalker, debtor and estranged relative.

The process failed precisely where it mattered — agents disclosed data even when the caller was visibly not the customer.

No one owned the risk: the practice ran for years without measurement or challenge until one victim's case reached the federal regulator.

1&1 benchmarked against the market ('standard practice at the time') instead of against the threat — the version of the story regulators never accept.

Authentication built on facts that are public or guessable protects nobody: a name and a birthdate identify a person but do not verify a caller. 'Industry standard' is not a security level.

1&1 moved to a five-digit service PIN for phone support in December 2019. The LG Bonn's judgment cut the fine to €900,000 and became the first German benchmark for GDPR fines: companies can be fined without individual attribution, but revenue-based amounts must stay proportionate to the actual breach. The BfDI said it was checking other telecom providers for the same authentication weakness.