The data of customers of numerous popular online platforms was disclosed to have been freely accessible for years. Among others, Check24, OTTO, Kaufland, MediaMarkt, Real/Kaufland, Idealo or Tyre24 are affected. Those affected have not yet been informed, although the problem has been known for almost half a year.
More than 700,000 people affected
More than 700,000 people from Germany are affected. Their personal data, including address, bank details, orders and telephone number, were freely accessible for years. According to ARD and SWR research, the data leak was discovered by a programmer back in the summer and has since been closed. However, those affected have not yet been informed, which is questionable from a data protection point of view. Stefan Brink, state data protection commissioner of Baden-Württemberg, speaks in this regard of a “serious and scandalous event.”
Kaufland does not consider itself responsible
Kaufland explained to the ARD magazine Plusminus not to be responsible for the information of those affected. The company attributes this to the fact that it merely serves as a platform for other companies, which ultimately conclude a contract with the end customers and are thus also responsible for the storage of the data.
Otto, MediaMarkt and Check24 also work in this way. The individual companies that offer their products via the marketplaces are connected via an interface, which in turn is provided by another company. For this reason, the customers’ data is processed by several companies. Who exactly is legally responsible for informing those affected in the current situation has not been clearly clarified. What is certain, however, is that all parties involved are responsible under the applicable data protection regulations, in particular the DGSVO, for protecting the data processed – which did not happen in this case.
Do state data protection commissioners intervene?
The statement from Baden-Württemberg’s state data protection commissioner makes it clear that responsible agencies are already monitoring the case. However, it is unclear at this point whether they will intervene, start investigations and take legal action.