You are here:
Provisions in the North-Rhine Westphalia Constitution Protection Act (Verfassungsschutzgesetz Nordrhein-Westfalen) on online searches and on the reconnaissance of the Internet null and void
Press Release No. 22/2008 of 27 February 2008
Judgment of 27 February 2008
1 BvR 595/07
The constitutional complaints of a journalist, of a member of the North-Rhine Westphalia Land association of the party DIE LINKE and of three lawyers against provisions of the North-Rhine Westphalia Constitution Protection Act are, insofar as they are admissible, largely well-founded. The First Senate of the Federal Constitutional Court declared the provisions on online searches and on reconnaissance of the Internet to be unconstitutional and null and void by judgment of 27 February 2008.
§ 5.2 no. 11 sentence 1 alternative 2 of the Constitution Protection Act (hereinafter: VSG), which regulates secret access to information technology systems ("online searches"), violates the general right of personality in its particular manifestation as a fundamental right to the guarantee of the confidentiality and integrity of information technology systems, and is null and void. The provision in particular does not meet the requirements of the principle of proportionality. In view of the gravity of the encroachment, the secret infiltration of an information technology system by means of which the use of the system can be monitored and its storage media can be read is constitutionally only permissible if factual indications exist of a concrete danger to a predominantly important legal interest. What is more, the encroachment is in principle to be placed under the reservation of a judicial order. § 5.2 no. 11 sentence 1 alternative 2 VSG does not meet these requirements. Over and above this, there are no adequate statutory precautions to avoid encroachments on the absolutely protected core area of private life.
The empowerment to secret reconnaissance of the Internet in § 5.2 no. 11 sentence 1 alternative 1 VSG also violates the constitution and is null and void. The secret reconnaissance of the Internet encroaches on the secrecy of telecommunication if the constitution protection authority monitors secured communication contents by using access keys which it collected without the authorisation or against the will of those involved in the communications. Such a grievous encroachment on fundamental rights is, in principle at least, also conditional on the provision of a qualified substantive encroachment threshold. This is not the case here. The provision permits intelligence service measures to a considerable degree in the run-up to concrete endangerment without regard to the grievousness of the potential violation of legal interests, and even towards third parties. What is more, the provision does not contain any precautions to protect the core area of private life. If, by contrast, the state obtains knowledge of communication contents which are publicly accessible on the Internet, or if it participates in publicly accessible communication processes, in principle it does not encroach on fundamental rights.
In essence, the ruling is based on the following considerations:
§ 5.2 no. 11 sentence 1 alternative 2 VSG ("online searches")
I. The provision grants powers to encroach on the general right of personality in its particular manifestation as a fundamental right to the guarantee of the confidentiality and integrity of information technology systems.
1. The use of information technology systems is vital to the development of personality of many citizens, whilst at the same time entailing new types of endangerment of personality. Surveillance of the use of such systems and evaluation of the data stored on the storage media can be highly illuminating as to the personality of the user, and may even make it possible to form a profile of that user. This entails a need for protection that is relevant from the fundamental-rights perspective. The guarantees contained in Article 10 of the Basic Law (Grundgesetz - GG; secrecy of telecommunication) and Article 13 GG (inviolability of the home), as well as the manifestations of the general right of personality previously developed in the case-law of the Federal Constitutional Court, do not adequately take account of the need for protection arising as a consequence of the development of information technology.
a) The area protected by the secrecy of telecommunication also covers the communication services of the Internet (such as e-mails). Insofar as empowerment is restricted to a state measure by means of which the contents and circumstances of ongoing telecommunication are collected in the computer network, or the data related thereto is evaluated, the encroachment is to be measured against Article 10.1 GG alone. The scope of protection of this fundamental right is affected here regardless of whether in technical terms the measure targets the transmission channel or the terminal used for telecommunication. Article 10.1 GG is therefore the sole fundamental right-related standard for the evaluation of an empowerment to engage in "source telecommunication surveillance" if the surveillance is restricted exclusively to data emanating from an ongoing telecommunication process. This must be ensured by technical precautions and legal instructions.
The protection of fundamental rights provided by Article 10.1 GG however does not cover the contents and circumstances of telecommunications stored subsequent to completion of the communication in the sphere of a subscriber, insofar as the latter can take their own protective precautions against secret data access. The protection effected by secrecy of telecommunication likewise does not apply if a state agency monitors the use of an information technology system as such or searches the storage media of the system. A loophole in protection exists in this respect which is to be closed by the general right of personality in its manifestation as a guardian of the confidentiality and integrity of information technology systems. If a complex information technology system is technically infiltrated in order to perform telecommunication surveillance, infiltration overcomes the vital hurdle to spying on the system as a whole. The endangerment thereby brought about goes far beyond that entailed by mere surveillance of ongoing telecommunication. In particular, the data stored on personal computers which does not relate to the use of the system for telecommunication can also be obtained.
b) Also the guarantee of the inviolability of the home leaves loopholes as regards access to information technology systems. Article 13.1 GG does not confer on the individual any across-the-board protection regardless of the access modalities against the infiltration of his or her information technology system, even if this system is located in a dwelling. The encroachment may take place regardless of the location, so that space-oriented protection is unable to avert the specific endangerment of the information technology system. Insofar as the infiltration uses the connection of the computer concerned to form a computer network, it leaves the spatial privacy provided by delimitation of the dwelling unaffected.
c) The manifestations of the general right of personality, in particular the guarantees of the protection of privacy and of the right to informational self-determination, previously recognised in the case-law of the Federal Constitutional Court, also do not comply sufficiently with the special need for the protection of the user of information technology systems. The need for protection of the user of an information technology system is however not restricted solely to data to be allotted to his or her privacy. The right to informational self-determination also does not fully do justice to personality endangerments. A third party accessing such a system can obtain data stocks which are potentially extremely large and revealing without having to rely on further data collection and data processing measures. In its severity for the personality of the person concerned, such access goes far beyond individual data collections against which the right to informational self-determination provides protection.
2. The general right of personality accounts for the need for protection in its loophole-filling function over and above its manifestations recognised thus far by virtue of the fact that it guarantees the integrity and confidentiality of information technology systems. This fundamental right is to be applied if the empowerment to encroach covers systems which, either alone or in their technical networking, can contain the personal data of the person concerned to such a degree and in such a diversity that access to the system facilitates an insight into significant parts of the life of a person, or indeed provides a revealing picture of their personality.
II. Encroachments on the fundamental right to the guarantee of the confidentiality and integrity of information technology systems may be justified both for preventive purposes, and for criminal prosecution. They must however be based on a statutory foundation that is constitutional. § 5.2 no. 11 sentence 1 alternative 2 VSG does not meet this precondition.
1. The provision in particular does not comply with the principle of proportionality.
a) § 5.2 no. 11 sentence 2 VSG grants powers to perform encroachments of a high intensity on fundamental rights. Data collection by the state from complex information technology systems provides the acting state agency with access to a stock of data which may far exceed traditional sources of information in terms of its scope and diversity. In view of the gravity of the encroachment, the secret infiltration of an information technology system by means of which the use of the system can be monitored and its storage media can be read is only permissible constitutionally if factual indications exist of a concrete danger to a predominantly important legal interest. These "predominantly important interests" are the life, limb and freedom of the individual or such interests of the public a threat to which affects the basis or continued existence of the state or the basis of human existence. The measure can however already be justified even if it cannot yet be ascertained with sufficient probability that the danger will arise in the near future insofar as certain facts indicate a danger posed to the predominantly important legal interest in the individual case.
Furthermore, empowerment to effect secret access to information technology systems must be linked with suitable statutory precautions in order to secure the interests of the person concerned under procedural law. In particular, access is in principle to be placed under the reservation of a judicial order.
b) § 5.2 no. 11 sentence 1 alternative 2 VSG does not meet these requirements. The provision makes the deployment of intelligence service means by the constitution protection authority merely contingent on the existence of factual indications of the presumption that information on anti-constitutional activities can be obtained by these means. This is not a sufficient substantive encroachment threshold, either as to the factual preconditions for the encroachment, or with regard to the weight of the legal interests to be protected. Also, there is no provision for a prior examination by an independent body. These shortcomings do not cease to apply by reference - provided for in certain cases - to the preconditions according to the Act re Article 10 GG. In connection with measures according to § 5.2 no. 11 sentence 1 alternative 2 VSG, neither the provision of the encroachment threshold, nor the procedural requirements of the encroachment elements provided for therein, comply with the constitutional requirements.
2. There are however also no adequate statutory precautions to avoid encroachments on the absolutely protected core area of private life. An investigation measure such as access to an information technology system, using which the data available on the target system can be comprehensively collected, creates in comparison to other surveillance measures an increased danger of data being collected which have highly personal contents. The constitutionally required protection of the core area can be guaranteed in the context of a two-tier protection concept: The statutory provision must endeavour to ensure that the collection of data that is relevant to the core area is avoided as far as possible in terms of information technology and investigation technique. In particular, available information technology security devices are to be deployed. If - as with secret access to an information technology system - it is practically unavoidable to obtain information before its reference to the core area can be evaluated, sufficient protection must be ensured in the evaluation phase. In particular, data that is found and collected which refers to the core area must be deleted without delay and its exploitation must be ruled out. § 5.2 no. 11 sentence 1 alternative 2 VSG also does not meet these requirements.
3. The provision further violates the principle of the clarity of provisions and determinedness of provisions.
§ 5.2 no. 11 sentence 1 alternative 1 VSG (Secret reconnaissance of the Internet)
I. Measures according to § 5.2 no. 11 sentence 1 alternative 1 VSG can in certain cases constitute an encroachment on the secrecy of telecommunication (Article 10.1 GG) which is constitutionally not justified.
If the state obtains knowledge of the contents of Internet communication by the channel technically provided therefor, this constitutes an encroachment on Article 10.1 GG if the state agency is not authorised to do so by those involved in the communication. This is the case if the constitution protection authority monitors secured communication contents by using access keys which it collected without the authorisation or against the will of those involved in the communications. If, by contrast, a state investigation measure focuses not on unauthorised access to telecommunication, but on the disappointment of the personal trust in the communication partner, this does not constitute an encroachment on Article 10.1 GG. Therefore, an encroachment on the secrecy of telecommunication is to be denied if for instance a participant of a closed chatroom has voluntarily provided the person acting for the constitution protection authority with his or her access, and as a consequence the authority uses this access. Encroachment on the secrecy of telecommunication certainly does not apply if the authority collects generally accessible contents, for instance by viewing open discussion fora or Web sites which are not password protected.
The encroachments on Article 10.1 GG facilitated by § 5.2 no. 11 sentence 1 alternative 1 VSG are constitutionally not justified. They are not in compliance with the principle of proportionality. The provision permits intelligence service measures to a considerable degree in the run-up to concrete endangerment without regard to the grievousness of the potential violation of legal interests, and also towards third parties. The provision also does not contain any precautions to protect the core area of private life.
II. The constitution protection authority may however continue to carry out measures of Internet reconnaissance insofar as these are not to be regarded as encroachments on fundamental rights. Pure Internet reconnaissance will not as a rule bring about an encroachment on fundamental rights. The confidentiality and integrity of information technology systems guaranteed by the general right of personality is not affected if the measures are restricted to data which the owner of the system has provided for Internet communication using the channel technically provided therefor. This also applies if the state agency enters a communication relationship under a cover. If there are no examination mechanisms, in the context of the communication services of the Internet, the trust of a communication partner in the identity and truthfulness of his or her communication partners is not worthy of protection. There is also no encroachment on the right to informational self-determination if a state agency collects communication contents that are available on the Internet addressing all readers or at least a group of individuals that is not further delimitated.
§ 5a.1 VSG (Account examination)
The collection of account contents and account movements provided in § 5a.1 VSG is in compliance with the Basic Law. In particular, the provision does not violate the right to informational self-determination. The provision satisfies the principle of proportionality by making the collection contingent on an element of endangerment that is qualified both as to the legal interests concerned, and as to the factual basis of the encroachment. The provision also takes account of the grievousness of the regulated encroachment on fundamental rights by means of suitable procedural precautions.