Federal Constitutional Court - Press office -
Press release no. 22/2008 of 27 February 2008
Judgment of 27 February 2008 – 1 BvR 370/07; 1 BvR 595/07 –
Provisions in the North-Rhine Westphalia Constitution Protection Act
(Verfassungsschutzgesetz Nordrhein-Westfalen) on online searches and on
the reconnaissance of the Internet null and void
The constitutional complaints of a journalist, of a member of the
North-Rhine Westphalia Land association of the party DIE LINKE and of
three lawyers against provisions of the North-Rhine Westphalia
Constitution Protection Act are, insofar as they are admissible,
largely well-founded. The First Senate of the Federal Constitutional
Court declared the provisions on online searches and on reconnaissance
of the Internet to be unconstitutional and null and void by judgment of
27 February 2008.
§ 5.2 no. 11 sentence 1 alternative 2 of the Constitution Protection
Act (hereinafter: VSG), which regulates secret access to information
technology systems ("online searches"), violates the general right of
personality in its particular manifestation as a fundamental right to
the guarantee of the confidentiality and integrity of information
technology systems, and is null and void. The provision in particular
does not meet the requirements of the principle of proportionality. In
view of the gravity of the encroachment, the secret infiltration of an
information technology system by means of which the use of the system
can be monitored and its storage media can be read is constitutionally
only permissible if factual indications exist of a concrete danger to a
predominantly important legal interest. What is more, the encroachment
is in principle to be placed under the reservation of a judicial order.
§ 5.2 no. 11 sentence 1 alternative 2 VSG does not meet these
requirements. Over and above this, there are no adequate statutory
precautions to avoid encroachments on the absolutely protected core
area of private life.
The empowerment to secret reconnaissance of the Internet in § 5.2 no.
11 sentence 1 alternative 1 VSG also violates the constitution and is
null and void. The secret reconnaissance of the Internet encroaches on
the secrecy of telecommunication if the constitution protection
authority monitors secured communication contents by using access keys
which it collected without the authorisation or against the will of
those involved in the communications. Such a grievous encroachment on
fundamental rights is, in principle at least, also conditional on the
provision of a qualified substantive encroachment threshold. This is
not the case here. The provision permits intelligence service measures
to a considerable degree in the run-up to concrete endangerment without
regard to the grievousness of the potential violation of legal
interests, and even towards third parties. What is more, the provision
does not contain any precautions to protect the core area of private
life. If, by contrast, the state obtains knowledge of communication
contents which are publicly accessible on the Internet, or if it
participates in publicly accessible communication processes, in
principle it does not encroach on fundamental rights.
In essence, the ruling is based on the following considerations:
§ 5.2 no. 11 sentence 1 alternative 2 VSG ("online searches")
I. The provision grants powers to encroach on the general right of
personality in its particular manifestation as a fundamental right
to the guarantee of the confidentiality and integrity of
information technology systems.
1. The use of information technology systems is vital to the
development of personality of many citizens, whilst at the same
time entailing new types of endangerment of personality.
Surveillance of the use of such systems and evaluation of the
data stored on the storage media can be highly illuminating as
to the personality of the user, and may even make it possible to
form a profile of that user. This entails a need for protection
that is relevant from the fundamental-rights perspective. The
guarantees contained in Article 10 of the Basic Law (Grundgesetz
- GG; secrecy of telecommunication) and Article 13 GG
(inviolability of the home), as well as the manifestations of
the general right of personality previously developed in the
case-law of the Federal Constitutional Court, do not adequately
take account of the need for protection arising as a consequence
of the development of information technology.
a) The area protected by the secrecy of telecommunication also
covers the communication services of the Internet (such as
e-mails). Insofar as empowerment is restricted to a state
measure by means of which the contents and circumstances of
ongoing telecommunication are collected in the computer
network, or the data related thereto is evaluated, the
encroachment is to be measured against Article 10.1 GG alone.
The scope of protection of this fundamental right is affected
here regardless of whether in technical terms the measure
targets the transmission channel or the terminal used for
telecommunication. Article 10.1 GG is therefore the sole
fundamental right-related standard for the evaluation of an
empowerment to engage in "source telecommunication
surveillance" if the surveillance is restricted exclusively
to data emanating from an ongoing telecommunication process.
This must be ensured by technical precautions and legal
instructions.
The protection of fundamental rights provided by Article 10.1
GG however does not cover the contents and circumstances of
telecommunications stored subsequent to completion of the
communication in the sphere of a subscriber, insofar as the
latter can take their own protective precautions against
secret data access. The protection effected by secrecy of
telecommunication likewise does not apply if a state agency
monitors the use of an information technology system as such
or searches the storage media of the system. A loophole in
protection exists in this respect which is to be closed by
the general right of personality in its manifestation as a
guardian of the confidentiality and integrity of information
technology systems. If a complex information technology
system is technically infiltrated in order to perform
telecommunication surveillance, infiltration overcomes the
vital hurdle to spying on the system as a whole. The
endangerment thereby brought about goes far beyond that
entailed by mere surveillance of ongoing telecommunication.
In particular, the data stored on personal computers which
does not relate to the use of the system for
telecommunication can also be obtained.
b) Also the guarantee of the inviolability of the home leaves
loopholes as regards access to information technology
systems. Article 13.1 GG does not confer on the individual
any across-the-board protection regardless of the access
modalities against the infiltration of his or her information
technology system, even if this system is located in a
dwelling. The encroachment may take place regardless of the
location, so that space-oriented protection is unable to
avert the specific endangerment of the information technology
system. Insofar as the infiltration uses the connection of
the computer concerned to form a computer network, it leaves
the spatial privacy provided by delimitation of the dwelling
unaffected.
c) The manifestations of the general right of personality, in
particular the guarantees of the protection of privacy and of
the right to informational self-determination, previously
recognised in the case-law of the Federal Constitutional
Court, also do not comply sufficiently with the special need
for the protection of the user of information technology
systems. The need for protection of the user of an
information technology system is however not restricted
solely to data to be allotted to his or her privacy. The
right to informational self-determination also does not fully
do justice to personality endangerments. A third party
accessing such a system can obtain data stocks which are
potentially extremely large and revealing without having to
rely on further data collection and data processing measures.
In its severity for the personality of the person concerned,
such access goes far beyond individual data collections
against which the right to informational self-determination
provides protection.
2. The general right of personality accounts for the need for
protection in its loophole-filling function over and above its
manifestations recognised thus far by virtue of the fact that it
guarantees the integrity and confidentiality of information
technology systems. This fundamental right is to be applied if
the empowerment to encroach covers systems which, either alone
or in their technical networking, can contain the personal data
of the person concerned to such a degree and in such a diversity
that access to the system facilitates an insight into
significant parts of the life of a person, or indeed provides a
revealing picture of their personality.
II. Encroachments on the fundamental right to the guarantee of the
confidentiality and integrity of information technology systems may
be justified both for preventive purposes, and for criminal
prosecution. They must however be based on a statutory foundation
that is constitutional. § 5.2 no. 11 sentence 1 alternative 2 VSG
does not meet this precondition.
1. The provision in particular does not comply with the principle
of proportionality.
a) § 5.2 no. 11 sentence 2 VSG grants powers to perform
encroachments of a high intensity on fundamental rights. Data
collection by the state from complex information technology
systems provides the acting state agency with access to a
stock of data which may far exceed traditional sources of
information in terms of its scope and diversity. In view of
the gravity of the encroachment, the secret infiltration of
an information technology system by means of which the use of
the system can be monitored and its storage media can be read
is only permissible constitutionally if factual indications
exist of a concrete danger to a predominantly important legal
interest. These "predominantly important interests" are the
life, limb and freedom of the individual or such interests of
the public a threat to which affects the basis or continued
existence of the state or the basis of human existence. The
measure can however already be justified even if it cannot
yet be ascertained with sufficient probability that the
danger will arise in the near future insofar as certain facts
indicate a danger posed to the predominantly important legal
interest in the individual case.
Furthermore, empowerment to effect secret access to
information technology systems must be linked with suitable
statutory precautions in order to secure the interests of the
person concerned under procedural law. In particular,
access is in principle to be placed under the reservation of
a judicial order.
b) § 5.2 no. 11 sentence 1 alternative 2 VSG does not meet these
requirements. The provision makes the deployment of
intelligence service means by the constitution protection
authority merely contingent on the existence of factual
indications of the presumption that information on
anti-constitutional activities can be obtained by these
means. This is not a sufficient substantive encroachment
threshold, either as to the factual preconditions for the
encroachment, or with regard to the weight of the legal
interests to be protected. Also, there is no provision for a
prior examination by an independent body. These shortcomings
do not cease to apply by reference - provided for in certain
cases - to the preconditions according to the Act re Article
10 GG. In connection with measures according to § 5.2 no. 11
sentence 1 alternative 2 VSG, neither the provision of the
encroachment threshold, nor the procedural requirements of
the encroachment elements provided for therein, comply with
the constitutional requirements.
2. There are however also no adequate statutory precautions to
avoid encroachments on the absolutely protected core area of
private life. An investigation measure such as access to an
information technology system, using which the data available on
the target system can be comprehensively collected, creates in
comparison to other surveillance measures an increased danger of
data being collected which have highly personal contents. The
constitutionally required protection of the core area can be
guaranteed in the context of a two-tier protection concept: The
statutory provision must endeavour to ensure that the collection
of data that is relevant to the core area is avoided as far as
possible in terms of information technology and investigation
technique. In particular, available information technology
security devices are to be deployed. If - as with secret access
to an information technology system - it is practically
unavoidable to obtain information before its reference to the
core area can be evaluated, sufficient protection must be
ensured in the evaluation phase. In particular, data that is
found and collected which refers to the core area must be
deleted without delay and its exploitation must be ruled out. §
5.2 no. 11 sentence 1 alternative 2 VSG also does not meet these
requirements.
3. The provision further violates the principle of the clarity of
provisions and determinedness of provisions.
§ 5.2 no. 11 sentence 1 alternative 1 VSG (Secret reconnaissance of the Internet)
I. Measures according to § 5.2 no. 11 sentence 1 alternative 1 VSG can
in certain cases constitute an encroachment on the secrecy of
telecommunication (Article 10.1 GG) which is constitutionally not
justified.
If the state obtains knowledge of the contents of Internet
communication by the channel technically provided therefor, this
constitutes an encroachment on Article 10.1 GG if the state agency
is not authorised to do so by those involved in the communication.
This is the case if the constitution protection authority monitors
secured communication contents by using access keys which it
collected without the authorisation or against the will of those
involved in the communications. If, by contrast, a state
investigation measure focuses not on unauthorised access to
telecommunication, but on the disappointment of the personal trust
in the communication partner, this does not constitute an
encroachment on Article 10.1 GG. Therefore, an encroachment on the
secrecy of telecommunication is to be denied if for instance a
participant of a closed chatroom has voluntarily provided the
person acting for the constitution protection authority with his or
her access, and as a consequence the authority uses this access.
Encroachment on the secrecy of telecommunication certainly does not
apply if the authority collects generally accessible contents, for
instance by viewing open discussion fora or Web sites which are not
password protected.
The encroachments on Article 10.1 GG facilitated by § 5.2 no. 11
sentence 1 alternative 1 VSG are constitutionally not justified.
They are not in compliance with the principle of proportionality.
The provision permits intelligence service measures to a
considerable degree in the run-up to concrete endangerment without
regard to the grievousness of the potential violation of legal
interests, and also towards third parties. The provision also does
not contain any precautions to protect the core area of private
life.
II. The constitution protection authority may however continue to carry
out measures of Internet reconnaissance insofar as these are not to
be regarded as encroachments on fundamental rights. Pure Internet
reconnaissance will not as a rule bring about an encroachment on
fundamental rights. The confidentiality and integrity of
information technology systems guaranteed by the general right of
personality is not affected if the measures are restricted to data
which the owner of the system has provided for Internet
communication using the channel technically provided therefor. This
also applies if the state agency enters a communication
relationship under a cover. If there are no examination mechanisms,
in the context of the communication services of the Internet, the
trust of a communication partner in the identity and truthfulness
of his or her communication partners is not worthy of protection.
There is also no encroachment on the right to informational
self-determination if a state agency collects communication
contents that are available on the Internet addressing all readers
or at least a group of individuals that is not further delimitated.
§ 5a.1 VSG (Account examination)
The collection of account contents and account movements provided in §
5a.1 VSG is in compliance with the Basic Law. In particular, the
provision does not violate the right to informational
self-determination. The provision satisfies the principle of
proportionality by making the collection contingent on an element of
endangerment that is qualified both as to the legal interests
concerned, and as to the factual basis of the encroachment. The
provision also takes account of the grievousness of the regulated
encroachment on fundamental rights by means of suitable procedural
precautions.
This press release is also available in the original german version.
|
