Germany’s AfD faces probe over donor data leak that could cost millions

The breach involved roughly 280 gigabytes of internal data, including about 420,000 emails and 50,000 documents, taken from an AfD hosting provider in September and released in October.

German daily Tagesspiegel reported that the leak exposed personal records of about 8,700 party supporters who made small donations of up to €150 ($167).

The party retained automated PayPal notifications and emailed bank statements containing the donors’ names, bank details, email addresses and home addresses, rather than deleting them once they were no longer needed for reporting.

Authorities are now investigating whether the AfD violated Germany’s data protection rules by failing to delete personal data on smaller donations after the reporting purpose had been fulfilled, the daily reported.

They are also examining whether the party took sufficient technical and organizational measures to prevent the incident.

Germany’s data protection rules require companies, authorities and parties to maintain a particularly high level of protection for sensitive data.

Organizations must take all necessary steps — such as encryption, logging and access restrictions — to make data leaks as unlikely as possible.

Under the rules, most violations can draw fines of up to €10 million ($11.16 million).

For particularly serious breaches, the ceiling rises to €20 million ($22.32 million).