According to a report by Germany’s Handelsblatt newspaper, which cited a whistleblower and 100 gigabytes of confidential information, Tesla has failed to protect data belonging to customers, employees, and business partners. The Guardian also reported that the carmaker has received numerous consumer complaints about its driver assistance system.
This follows a Reuters article from last month that stated Tesla employees had shared invasive videos and photos taken by consumers’ car cameras without their knowledge between 2019 and 2022.
The recent Handelsblatt article revealed that a data file called the “Tesla Files” contained a significant amount of client data, including tables with over 100,000 names of current and former employees, including CEO Elon Musk and his social security number. The file also contained confidential information such as private email addresses and phone numbers.
The publication noted that such a breach would violate the General Data Protection Regulation (GDPR), a comprehensive data protection law implemented by the European Union (EU) to safeguard individuals’ personal data and privacy rights. It regulates how organizations collect, use, store, and process personal data.
The data protection office in the German state of Brandenburg, where Tesla’s European gigafactory is located, referred to the data leak as “massive.” Dagmar Hartge, the Brandenburg data protection officer, expressed astonishment at the scale of the breach. If proven, Tesla could face fines of up to 4% of its annual sales, amounting to around €3.26 billion ($3.5 billion).
Additionally, there have been numerous consumer complaints about Tesla’s driver assistance features, including over 4,000 complaints regarding sudden acceleration or phantom brakes.
The German union IG Metall found the disclosures concerning and urged Tesla to inform its staff about all data protection violations. The union called for an environment where employees can freely voice concerns and grievances without fear.
According to a Tesla lawyer quoted by Handelsblatt, a former disgruntled employee took advantage of their position as a service technician. The lawyer stated that Tesla intends to file a lawsuit against the suspected leaker.
The data protection agency in the Netherlands is aware of potential data security violations by Tesla, as notified by the data protection agency in Brandenburg, Germany. Tesla reportedly informed the Dutch authorities about the breach, although the Dutch agency claimed to be unaware of any disclosures made by the company.
Earlier, leaked video clips showed Tesla owners in compromising situations. One ex-employee recounted a video of a naked man approaching a Tesla vehicle, while another video depicted a Tesla involved in a collision with a child on a bike in a residential neighborhood.
In unrelated news, Facebook’s parent company Meta was fined a record €1.2 billion by the top EU privacy authority for mishandling user data. Meta has been given five months to cease sending user data to the United States.