edit: Found it way down the page: https://www.telekom.com/resource/blob/323318/ce2bab699cb8cb2...
edit2: Fascinating, the term "independent stock corporation" seems to be exclusively used by German-speaking companies: https://duckduckgo.com/?q=%22independent+stock+corporation%2...
"Data collected in Europe shall be processed generally in accordance with the legal provisions of the country in which the data was collected, regardless of where the data is processed, but at the very least in accordance with the requirements of these Binding Corporate Rules Privacy."
His data wasn't collected in Europe.
" For Deutsche Telekom AG from July 01, 2014 in accordance with approval by the Board of Management on June 10, 2014. In the domestic Group companies, as per board approval or decision of the responsible board member."
Where's the board approval of the US board?
How about the GDPR?
" The whole point of the GDPR is to protect data belonging to EU citizens and residents. The law, therefore, applies to organizations that handle such data whether they are EU-based organizations or not, known as “extra-territorial effect.”" (gdpr.eu)
Is he an EU citizen?
Based on his biography (hasbrouck.org/bio/whoami.html) I believe he is an American citizen. I see records about him being born in the USA and nothing about any moves to a European country (other than his world travels for activism and other short-term purposes). If he were a European citizen, I'd expect his complaints to be directed at his local DPA rather than at DT/T-Mobile directly.
I'm no lawyer so I'm not sure how legally binding his communication with T-Mobile/DT about the exact use of his data really is.
I always thought of the cost implication for T-Mobile before this thread, not that they are probably more concerned with legal exposure of people changing residency and trying to remain as customers.