Federal Constitutional Court - Press office -
Press release no. 13/2012 of 24 February 2012
Order of 24 January 2012 – 1 BvR 1299/05 –
Provisions of Telecommunications Act on storage and
use of telecommunications data unconstitutional in part
The constitutional complaint challenges §§ 111 to 113 of the
Telecommunications Act (Telekommunikationsgesetz – TKG).
1. § 111 TKG imposes a duty on commercial providers of
telecommunications services to collect and store the telecommunications
numbers (telephone numbers, line identification numbers, mobile end
device numbers and identifiers of email accounts) which they allocate or
provide and the related personal data such as names, addresses and dates
of birth.
§§ 112, 113 TKG create the basis for two different procedures to supply
information from the data stored under § 111 TKG. In the automated
procedure governed by § 112 TKG, the providers of telecommunications
services must supply the data in such a way that they can be accessed by
the Federal Network Agency (Bundesnetzagentur) without the providers
having notice of this. The Federal Network Agency must retrieve the data
on the application of specifically designated authorities, including in
particular the criminal prosecution and law enforcement authorities,
using the automated procedure, and communicate it to them. The
information may always be given if it is necessary to comply with
statutory obligations.
The manual procedure governed by § 113.1 sentence 1 TKG, in contrast,
imposes on the telecommunications enterprises themselves a duty to
supply information. It is not only the suppliers who offer
telecommunications services to the public (e.g. telephone companies and
providers) who have a duty to provide information, but also all those
who provide telecommunications services on a commercial basis
(including, for example, hospitals, or if applicable hotels). Under this
provision, all authorities are in principle entitled to receive
information. It is a requirement that in the individual case the
information is needed to prosecute criminal offences and regulatory
offences, to avert dangers or for intelligence activities.
§ 113.1 sentence 2 TKG creates a special duty to provide information
with regard to access codes such as passwords or personal identification
numbers (PINs). In this connection, those entitled to receive
information include the criminal prosecution authorities and the
security and intelligence services.
In the interpretation of § 113 TKG, there is a widespread but
controversial practice of giving information in addition on the holder
of what is known as a dynamic Internet Protocol address (dynamic IP
address). These are the telecommunications numbers under which above all
private persons surf the internet.
The retrieval of the data by the authorities entitled to receive
information is governed by their own legal basis; in practice, a legal
basis which gives the authorities a general power to collect data has
been regarded as sufficient.
2. The complainants use prepaid mobile phone cards and internet access
services and assert that their fundamental rights are violated by the
storage of their data and the potential communication of these in the
information procedures.
3. The First Senate of the Federal Constitutional Court held that the
collection and storage of telecommunications data under § 111 TKG and
their use in the automated information procedure governed by § 112 TKG
are constitutional. The encroachment upon the right to informational
self-determination effected by this is of only limited weight, and is
justified in view of the aim of improving the state’s performance of its
duties. In this connection, the general data retrieval regulations of
the authorities entitled to retrieve are also sufficient.
The constitutional complaint is also unsuccessful insofar as it
challenges the provisions contained in § 113.1 sentence 1 TKG for the
telecommunications service providers to give general information in the
manual information procedure. However, the provision must be interpreted
in conformity with the Basic Law (Grundgesetz – GG) to the effect that
special enabling legislation is required for data retrieval. In
addition, § 113.1 sentence 1 TKG does not permit dynamic IP addresses to
be attributed to persons. For a transitional period, until 30 June 2013
at the latest, the provision may be applied without these conditions.
However, § 113.1 sentence 2 TKG is not compatible with the right to
informational self-determination. But the provision is to continue in
effect on an interim basis, until 30 June 2013 at the latest, provided
that the access codes may be collected only subject to the conditions
which, under the applicable provisions in each case (for example the
provisions of criminal law), govern their use.
In essence, the decision is based on the following considerations:
I. The provisions challenged are in essence to be measured against the
right to informational self-determination under Article 2.1 in
conjunction with Article 1.1 GG. The duties of the service providers
laid down in §§ 111 to 113 TKG to collect, store and supply the data,
just like the power of the Federal Network Agency to access these data
and to communicate them, or like the power of the telecommunications
providers to give information, are in each case independent
encroachments upon this fundamental right. In addition, there is a
further independent encroachment on fundamental rights in the retrieval
of the data, which requires a separate legal basis apart from §§ 112,
113 TKG. Thus, there must be corresponding legal bases for the retrieval
and for the supply of information, and these act together like double
doors.
In contrast, the challenged provisions – as long as they are not used to
attribute dynamic IP addresses – do not encroach upon the secrecy of
telecommunications of Article 10.1 GG. This fundamental right only
protects the confidentiality of specific telecommunications events, but
not the confidentiality of the relevant circumstances of the provision
of telecommunications services. The storage and supply of information
ordered in §§ 111 to 113 TKG relates solely to the abstract attribution
of telecommunications numbers to particular subscribers, and just like
the attribution of a static IP address to a user, this is not within the
area of protection of Article 10 GG.
In contrast, the attribution of dynamic IP addresses is an encroachment
upon the secrecy of telecommunications. For in order to identify a
dynamic IP address, the telecommunications enterprises must examine the
relevant connection data of their customers and thus access specific
telecommunications events which fall within the area of protection of
Article 10 GG.
II. The duty of storage of § 111 TKG is constitutionally
unobjectionable. It serves to maintain a reliable data basis for the
supply of information governed by §§ 112, 113 TKG, which permits
particular authorities to attribute telecommunications numbers to
individual subscribers. The improvement of the state’s performance of
its duties aimed at by this, above all in the area of the prosecution of
criminal offences, the averting of dangers and intelligence activities,
is a legitimate purpose which justifies the encroachment upon
fundamental rights. § 111 TKG provides for a selective retention of
particular data, restricted in their scope and with a precisely defined
information content, for the purposes defined in detail in §§ 112, 113
TKG; this does not violate the strict prohibition of data retention.
§ 111 TKG is not disproportionate. In view of the information content of
the data collected, which is not very extensive, this is an encroachment
of limited weight. The data do not of themselves provide information on
specific activities of individuals, but merely make it possible to
individually attribute telecommunications data numbers to the
subscribers in question. In a fundamentally different way than in the
case of precautionary storage of all telecommunications traffic data,
neither do these data as such contain highly personal information, nor
is it possible to use them to create personality profiles or track
users’ movements. Nor does § 111 TKG cover dynamic IP addresses. The
possibility of attribution of the data collected in § 111 TKG serves the
effective performance of the duties of the authorities defined in more
detail in the provisions on use. It is constitutionally justified by the
fact that the state may have a legitimate interest in successfully
investigating particular telecommunications events if occasion arises,
and this interest in the performance of particular tasks may have
considerable weight, in individual cases even pre-eminent weight.
III. The automated information procedure under § 112 TKG is also
compatible with the constitution. The provision is the legal basis for
the duty of service providers to supply the data as a customer file and
for access to these data by the Federal Network Agency and their
communication to the authorities entitled to receive information. For
the retrieval of the data by the authorities, § 112 TKG, by analogy with
the “double door” model, requires independent enabling legislation; the
general data collection provisions of the relevant authorities entitled
to receive information are sufficient.
1. § 112 TKG does not violate the system of competencies of the Basic
Law. The Federal legislature was entitled to legislate for the automated
information procedure on the basis of its competence for
telecommunications law under Article 73.1 no. 7 GG. This also includes
passing legislation on data protection in this area and at the same time
establishing when an authority may communicate data despite these
requirements of data protection law. In contrast, its legislative
competence ends where the retrieval of such information is concerned.
The authorisations to retrieve data themselves require an independent
legal basis from the Federal legislature or else they are given by the
Länder (states). Since § 112 TKG only governs data exchange between
authorities, there are no objections in the law relating to competence
to the Federal legislature passing legislation on the information
procedure with the effect that all that remains for the Länder to do is
to provide general data collection provisions for data retrieval, for
the right of the Länder to make the final decision on whether and how
data is to be retrieved is unaffected.
2. § 112 TKG satisfies the requirements of the principle of
proportionality. The provision serves to improve the effectiveness of
the state’s performance of its duties. The purposes for which the
authorities are given information under § 112.2 TKG are central duties
relating to the guarantee of security. In view of the importance of
electronic means of communication in all areas of life, the authorities
depend on being able to attribute telecommunications numbers
individually. It is constitutionally unobjectionable for the legislature
to permit the communication of these data in order that criminal
offences and dangers are investigated, to observe developments which
endanger the constitution in order for the government and the public to
be informed or for assistance to be given in emergencies. Nor is the
provision disproportionate in the present state of technological
development and practice on the grounds that in certain circumstances it
makes it possible to identify static IP addresses, for since at the
present time these are as a general rule allocated only to institutions
and major users, but not to private users as individual customers, the
possibility of retrieving such numbers has little weight. But the
legislature does have a duty to observe and where appropriate to correct
in this connection. However, § 111 TKG does not cover dynamic IP
addresses, and therefore § 112 does not enable these to be
de-anonymised. IV. The manual information procedure under § 113.1
sentence 1 TKG is also compatible with the constitution.
1. But in two respects the provision needs to be interpreted in
conformity with the constitution.
a) Firstly, it must be interpreted for reasons of the law relating to
competence and also for constitutional reasons in such a way that it in
itself alone does not create duties of information of the
telecommunications enterprises. Since these are duties of information of
private individuals, the authorities entitled to receive information
need separate enabling legislation under special law, if appropriate
under Land law, in order to retrieve the data; this legislation must be
independent and have clear definitions and must create an obligation of
the telecommunications service providers to the authorities entitled to
retrieve. For in the law relating to competence, creating a duty of
information of private persons is not part of the definition of the
purposes of the communication, but part of the retrieval. It follows
from the principle of clear statutory definition that it must be
sufficiently clearly laid down in this connection which authorities the
providers are specifically to be obliged to inform.
b) Secondly, the provision may not be used to attribute dynamic IP
addresses. This is not permitted inter alia because the attribution of
dynamic IP addresses must be defined as an encroachment upon Article
10.1 GG. Such encroachments are subject to the citation requirement of
Article 19.1 sentence 2 GG which requires the legislature to name the
fundamental right upon which an encroachment is made and to state the
number of the Article in which it is contained. This is lacking in the
present case. Apart from this, § 113.1 TKG does not define with
sufficient clarity whether it is also to permit an identification of
such addresses, which has its own weight.
2. On the basis of the above stipulations, § 113.1 sentence 1 TKG
satisfies the requirements of the principle of proportionality. In view
of the limited information content of the data in question and their
great importance for an effective performance of duties, the reach of
the provision is constitutionally unobjectionable. It by no means
enables information to be given indiscriminately as a general means of
lawful administrative enforcement, but requires that the measure be
necessary in the individual case in order to discharge a duty of a
security nature. The broad range of persons obliged to give information
is also justified in view of the aim of making investigations more
effective.
V. In contrast, the provision of § 113.1 sentence 2 TKG violates the
fundamental right to informational self-determination because it does
not satisfy the requirements of the principle of proportionality. The
provision relates to the access codes which protect the access to end
user devices and thus protect the persons in question against access to
the data or telecommunications events involved. But access to these data
is not necessary in the degree provided by § 113.1 sentence 2 TKG for
these authorities to perform their duties effectively. The provision
makes these data accessible to the authorities and thus puts the
authorities in the position to surmount the relevant barriers, but it
does not legislate on the requirements for the use of these codes. On
the contrary, as is made clear by § 113.1 sentence 3 TKG, these
requirements are solely to be defined by independent legal provisions in
non-constitutional law, for example by the relevant provisions of the
Code of Criminal Procedure (Strafprozessordnung – StPO). But no reason
is apparent for the authorities to be able to retrieve the access codes
governed by § 113.1 sentence 2 TKG independently of the requirements for
their use and thus in some circumstances subject to less stringent
conditions. The collection of the access data governed by § 113.1
sentence 2 TKG, in view of the purposes pursued there, is necessary only
if the requirements for their use are also satisfied. The provision of §
113.1 sentence 2 TKG does not sufficiently ensure this in its present
wording.
VI. The Federal Constitutional Court did not declare the
unconstitutional provision of § 113.1 sentence 2 TKG null and void, but
ordered that it should continue in effect for an interim period subject
to the proviso that the security services may only require information
on access codes such as PINs and PUKs if the statutory requirements for
their use are satisfied. For if the provision were declared null and
void, the result would be that even in the cases in which the
authorities are lawfully entitled to have access to telecommunications
data to prevent or punish serious violations of legal interests it would
not be sufficiently ensured that they were in the position to do this.
In view of the limited weight of the encroachment upon fundamental
rights, this would not be acceptable even for an interim period. For the
same reasons, a transitional arrangement is necessary with regard to the
constitutional requirements of the interpretation of § 113.1 sentence 1
TKG. If these requirements came into effect immediately, there would be
a large number of cases in which neither would information on
telecommunications numbers be possible nor could dynamic IP addresses be
identified until new retrieval rules were issued in non-constitutional
law.
This press release is also available in the original german version.
|
