Data leak of Alternative for Germany donors: party under review for storing personal data

What happened

The Alternative for Germany (AfD) party is facing a data protection review after hackers published the personal details of thousands of its donors. As the Anadolu agency reported, citing local media, the party's hosting provider was hacked in September, and the stolen data was published in October. The total volume of the leak amounted to about 280 gigabytes: roughly 420,000 emails and 50,000 documents.

Who was affected by the leak

According to the German newspaper Tagesspiegel, cited by Anadolu, the leak exposed the personal records of about 8,700 party supporters who had made small donations of up to 150 euros (about 167 dollars). The problem is that AfD kept automatic PayPal notifications and bank statements sent by email containing donors' names, bank details, email addresses and home addresses, instead of deleting this data once it was no longer needed for reporting purposes.

What the authorities are investigating and what the risks are

The authorities are determining whether AfD violated German data protection rules by failing to delete personal information about small donations after the reporting purpose had been fulfilled. It is also being examined whether the party took sufficient technical and organizational measures to prevent such an incident. Under the current rules, organizations — including companies, government bodies and parties — are required to ensure a particularly high level of protection for sensitive data, including encryption, access logging and access restrictions. Most violations can result in a fine of up to 10 million euros (11.16 million dollars), and in particularly serious cases up to 20 million euros (22.32 million dollars). For now, only an investigation is underway: sources do not report any conclusions about the party's culpability.