A routine accreditation system became a long-term security risk for at least 1,000 journalists after Germany’s far-right Alternative for Germany (AfD) kept personal data on internal party resources, including press-card photographs showing private home addresses.
An investigation by German outlet CORRECTIV, published on 29 October 2026, found that links to the documents were available to AfD members through the party’s website. The confidential information was removed only after CORRECTIV contacted the party. Berlin’s data-protection commissioner has since included the case in a review.
Accreditation records became a personal-data archive
The documents emerged from a leak of internal AfD material covering preparations for party congresses between 2017 and 2025. They included lists of accredited media workers and images of press credentials. Some of those images left residential addresses visible.
Recording which journalists will attend a political event is a normal organisational task. Parties need accreditation lists to manage access, issue passes and plan for security. But a list of names and news organisations is very different from an archive of identification documents containing details about where reporters live.
The material remained accessible for years, rather than being limited to the particular event for which it had been collected. Links to the files could be reached by party members on internal resources connected to the AfD website, according to CORRECTIV. The confidential data was taken down only after the publication asked questions about it.
That sequence is central to the case. The concern is not simply that the AfD recorded journalists’ attendance at its congresses. It is that information gathered for a narrow administrative purpose was retained, combined with sensitive documents and made available beyond the immediate needs of accreditation.
Why residential addresses carry a different risk
A private home address is not an ordinary professional contact detail. If it is circulated beyond the people who need it, unwanted contact, harassment or intimidation becomes easier. The exposure is particularly sensitive when an address is linked to a person’s name, profession and attendance at events organised by a political party that may be the subject of critical reporting.
Representatives of journalists’ organisations have warned that the practice may breach personal-data protection requirements and endanger the people whose details were exposed. They have also raised concerns that such records could increase pressure on media outlets that report critically on the AfD by making it easier to identify reporters covering the party.
Those warnings describe possible consequences, not proof that every journalist in the files was targeted or that the addresses were used in a particular intimidation campaign. The documented issue is the prolonged availability of sensitive information and its removal only after CORRECTIV’s inquiry.
The exposure can affect journalists even if no one contacts them directly. Knowing that a political organisation has retained copies of press credentials with home addresses may change how safe reporters feel when covering its events. It may also lead news organisations to reconsider what personal information they provide during accreditation.
Berlin authority adds the case to its review
Following CORRECTIV’s request for information, Berlin’s data-protection commissioner included the matter in an examination. The review can assess whether the AfD’s storage arrangements complied with data-protection rules, whether access controls were adequate and how long copies of press cards could properly be retained.
It may also establish whether the records were kept for a defined purpose and whether the party had a process for deleting them after individual events. Those questions matter because an internal system can still expose personal information to more users, and for longer, than the original task requires.
Removing the files limits further access through the original resources, but it does not show whether documents were copied or forwarded while the links were active. Data deleted from one system may continue to exist elsewhere, particularly after years of availability.
The question that remains after deletion
The case illustrates how an administrative database can become a personal-security problem when identifying documents are stored without a clear limit and linked to people’s homes. A process intended to organise entry to a party congress can create a much wider vulnerability when privacy safeguards fail.
The outstanding questions are therefore both legal and practical: how widely the documents circulated, whether copies still exist and what protection will be offered to the journalists concerned. The data-protection review will determine how the AfD’s procedures are judged. It may also show whether the episode was confined to poor data handling or exposed a deeper failure to protect the people reporting on the party.
