Authorities looking into possible Tesla data protection violations

German authorities have serious indications of possible data protection violations by Tesla, Handelsblatt newspaper reported on Thursday, citing the data protection office in the state where the carmaker has its European gigafactory.

Handelsblatt’s report said the U.S. electric car manufacturer has failed to adequately protect data from customers, employees and business partners, citing 100 gigabytes of confidential data leaked to the newspaper by a whistleblower.

The data protection supervisory authority in the Netherlands, where Tesla’s European headquarters is located, has been informed of the case, the newspaper said, adding that Tesla also filed a preliminary report to the Dutch authorities on the matter.

The European Union’s General Data Protection Regulation, or GDPR, stipulates that companies are obliged to do so if they fear personal data may have been leaked.

The Brandenburg data protection office was not immediately available for comment.

Tesla was not immediately available for comment on the report.

Handelsblatt said customer data could be found “in abundance” in the data set, dubbed “Tesla Files.”

The files include tables containing more than 100,000 names of former and current employees, including the social security number of Tesla Chief Executive Elon Musk, along with private email addresses, phone numbers, salaries of employees, bank details of customers and secret details from production.

The breach would violate the GDPR, the newspaper added.

Handelsblatt quoted a lawyer for Tesla as saying a “disgruntled former employee” had abused his access as a service technician to get information, adding that the company would take legal action against the suspected ex-employee.

The whistleblower notified the German authorities about the data protection breach in April, according to the newspaper.

The matter would become serious from a data protection point of view if the evidence becomes substantial, a spokesperson for Brandenburg data protection office was quoted as saying by Handelsblatt.

Citing the leaked files, the newspaper reported about thousands of customer complaints regarding the carmaker’s driver assistance systems with around 4,000 complaints on sudden acceleration or phantom breaking.

Last month, a Reuters report showed that groups of Tesla employees privately shared via an internal messaging system sometimes highly invasive videos and images recorded by customers’ car cameras between 2019 and 2022.

This week, Facebook parent Meta was hit with a record 1.2 billion euro ($1.3 billion) fine by its lead European Union privacy regulator over its handling of user information and given five months to stop transferring users’ data to the U.S.