D: Continuing trade in illegal data

One year after the purchase of data on the Internet by the consumer organization of Schleswig-Holstein, the TV station NDR has still been able to purchase millions of qualified data records on the Internet.

During its investigation, NDR was offered data relating to 1.5 million German citizens. A test purchase of 3,000 files contained the name, address, phone number and date of birth, as well as the bank details of the people involved. Further investigation showed the data to have been collected by call centers. The transaction was arranged via third countries which are located outside of the European Economic Area and thus subject neither to the regulations of the Federal Data Protection Act (Bundesdatenschutzgesetz - BDSG) nor to those of the European Community (directive 95/46/EC).

However, it can be assumed that the data originated in Germany and that the loss of these data does fall under the regulations of the BDSG.

All that can be done is to advise German call centers to place their employees under a sufficient level of obligation to data protection and to establish a suitable authorization system to make unwanted extraction of the data very difficult.

Clients using call centers are from September 2009 on to be subject to an extended supervisory obligation. They need to monitor their service providers on a regular basis for compliance with data protection regulations. This includes not only technical security, but also organizational measures such as raising awareness amongst employees.