HEADNOTES

to the Judgment of the First Senate of 15 December 1983

1 BvR 209, 269, 362, 420, 440, 484/83

1. In the context of modern data processing, the general right of personality under Article 2(1) in conjunction with Article 1(1) of the Basic Law encompasses the protection of the individual against the unlimited collection, storage, use and sharing of their personal data. This fundamental right confers upon the individual the authority to, in principle, decide themselves on the disclosure and use of their personal data.

2. Restrictions of this right to ‘informational self-determination’ are only permissible if they serve an overriding public interest. They require a statutory basis that must be constitutional and must satisfy the requirement of legal clarity under the rule of law. In the design of the statutory framework, the legislator must furthermore observe the principle of proportionality. It must also provide for organisational and procedural safeguards that counter the risk of violating the general right of personality.

3. As for the constitutional requirements applicable to such restrictions, a distinction must be made between personal data that is collected and processed as individualised information and not rendered anonymous, and data intended for statistical purposes.

1. Where data is collected for statistical purposes, requiring a strict and specific purpose limitation would not be feasible. However, to compensate for the lack of such a purpose limitation, the collection and processing of such information must be subject to other adequate limitations within the relevant information system.

4. The data collection provided for under the 1983 Census Act (§ 2 nos. 1 to 7, §§ 3 to 5 of the Act) does not amount to the registration and cataloguing of the data subjects’ personality in a manner that would be incompatible with human dignity; the relevant provisions also satisfy the requirements of legal clarity and proportionality. However, it is imperative that additional procedural safeguards be put in place in order to ensure that the right to informational self-determination is respected in the implementation and organisation of the census data collection.

5. The legal provisions governing the transfer of data under § 9(1) to (3) of the 1983 Census Act (including the comparison of census data with civil registry records) violate the general right of personality. However, the sharing of data for scientific purposes (§ 9(4) of the 1983 Census Act) is compatible with the Basic Law.

FEDERAL CONSTITUTIONAL COURT

- 1 BvR 209, 269, 362, 420, 440, 484/83 -

IN THE NAME OF THE PEOPLE

In the proceedings

on the constitutional complaints of

- 1 BvR 209/83 -,

- 1 BvR 269/83 -,

- 1 BvR 362/83 -,

- 1 BvR 420/83 -,

- 1 BvR 440/83 -,

- 1 BvR 484/83 -

the Federal Constitutional Court – First Senate –

with the participation of Justices

President Benda,

Simon,

Hesse,

Katzenstein,

Niemeyer,

Heußner,

Niedermaier,

Henschel

held on the basis of the oral hearing of 18 and 19 October 1983:

JUDGMENT

1. 1. § 2 nos. 1 to 7 and §§ 3 to 5 of the Act on a Census Surveying Population, Occupation, Housing and Workplaces (1983 Census Act) of 25 March 1982 (BGBl I, p. 369) are compatible with the Basic Law; however, the legislator must ensure that additional organisational and procedural rules for the census be put in place in accordance with the reasons set forth in this judgment.

2. 2. § 9(1) to (3) of the 1983 Census Act is not compatible with Article 2(1) in conjunction with Article 1(1) of the Basic Law, and is thus void.

3. 3. To the extent set out in nos. 1 and 2 above, the Census Act violates the complainants’ fundamental rights under Article 2(1) in conjunction with Article 1(1) of the Basic Law.

4. For the rest, the constitutional complaints are rejected.

REASONS:

A.

The constitutional complaints directly challenge the Act on a Census Surveying Population, Occupation, Housing and Workplaces (1983 Census Act) of 25 March 1982 (BGBl I, p. 369).

The data collection prescribed by the challenged Act has sparked concern among the general public, even among law-abiding citizens who recognise the power and duty of the state to gather the information necessary for rational and well-planned government action. In part, this may be attributable to wide-spread misconceptions regarding the scope and purposes of the survey; due to new developments in automatic data processing, the general perception of such measures has changed significantly since the microcensus data collections from 1956 to 1962 were carried out (cf. BVerfGE 27, 1). It was not recognised early enough that it would be necessary to provide reliable information to the census subjects concerning the envisaged collection of their data. Nowadays, only experts can fully grasp the possibilities of modern data processing, which may prompt citizens to fear that personality profiles are being compiled beyond their control, even if the legislator limits their obligation to provide information to what is necessary and reasonable (zumutbar ). [...]

I.

1. The 1983 Census Act, in its §§ 1 to 8, specifies the data collection framework and its implementation. § 9 further specifies the regime governing the use and sharing of the collected data. The key provisions read:

[…]

§ 2

The population and occupation census shall record:

1. given names and surnames, address, telephone number, sex, date of birth, marital status, legal membership (or lack thereof) in a religious community, nationality;

2. use of dwelling as exclusive, primary or secondary residence (§ 12(2) of the Framework Act on Civil Registration);

3. primary source of income;

4. participation in the workforce, status as housewife, pupil or student;

5. professional qualifications, duration of vocational training, highest qualification obtained in general education, highest qualification obtained in vocational or higher education, including the major field of study in which the most recent qualification was obtained;

6. regarding the working population, pupils and students: name and address of the workplace or training facility, primary means of transport used and time spent getting to and from work or education;

7. regarding the working population: line of business of employer, professional position, type of occupation carried out, working hours, secondary occupations (agricultural and non-agricultural);

8. regarding detention facilities and institutions: status as inmate or staff member or staff family member.

§ 3

(1) The building-related survey shall record the address, type and year of construction as well as ownership information for residential buildings or buildings in permanent residential use [...].

(2) The dwelling-related survey shall record:

1. type, size, fixtures and fittings, intended use, type of heating and heating supply, year of taking up residence, living arrangements, subsidies received under affordable housing programmes as well as number and usage of individual rooms;

2. regarding rented apartments: amount of monthly rent;

3. regarding vacant apartments: duration of vacancy.

§ 4

The workplace census shall record:

1. regarding non-agricultural workplaces and companies:

a) name, designation, address, telephone numbers and number of telephone stations, type of establishment, type of activities or tasks performed at the workplace or company, start of business operations (year), information on (new) establishments or relocation, the responsible body for workplaces in facilities or institutions of public authorities or of social insurance providers, as well as of churches, associations or other organisations,

b) number of staff disaggregated by sex, company position, number of part-time employees as well as number of foreign employees disaggregated by sex,

c) total amount of gross wages and salaries paid in the preceding calendar year;

2. regarding main establishments and single-location establishments:

a) registration of the company in the register of craft businesses,

b) legal form of the company;

3. regarding main establishments, in addition to nos. 1 and 2 above, information for each branch establishment on:

a) names, designation, address, type of activities or task performed,

b) number of staff,

c) total amount of gross wages and salaries paid in the preceding calendar year.

[§§ 5-7 …]

§ 9

(1) Census data collected pursuant to § 2 nos. 1 and 2 may be compared with the civil registers and used for the purposes of correcting the latter. The information obtained from this data may not be used for taking measures against the individual census subject.

(2) In relation to the census elements listed in §§ 2 to 4, the statistical offices of the Federation and the Länder may transfer individual data, excluding names, to the competent highest federal and Land authorities pursuant to § 11(3) of the Federal Statistics Act of 14 March 1980 (BGBl I, p. 289) to the extent that the relevant information is necessary for the lawful exercise of functions conferred upon the respective authorities. With the exception of information on legal membership (or lack thereof) in a religious community collected pursuant to § 2 no. 1, and on the census elements listed in § 4 no. 1 lit. c and § 4 no. 3 lit. c, the first sentence of this subsection also applies to the transfer of data to authorities designated by the competent highest authorities of the Federation or the Länder and to other public and non-public bodies, to the extent that the data transfer is necessary for the lawful exercise of functions conferred upon the competent highest authorities of the Federation or the Länder . In this regard, the second sentence of subsection 1 applies accordingly.

(3) With the exception of information on legal membership (or lack thereof) in a religious community collected pursuant to § 2 no. 1, and on the census elements listed in § 4 no. 1 lit. c and § 4 no. 3 lit. c, the statistical offices of the Länder may transfer to municipalities and municipal associations individual data, excluding names, of the census subjects residing in the relevant jurisdiction for purposes relating to regional planning, surveying, municipal planning and environmental protection. […]

(4) For scientific purposes, the statistical offices of the Federation and the Länder may transfer individual data, excluding names and addresses, on the census elements listed in §§ 2 to 4, with the exception of information on legal membership (or lack thereof) in a religious community collected pursuant to § 2 no. 1, and on census elements listed in § 4 no. 1 lit. c and § 4 no. 4 lit. c, to public officials and persons of equivalent status.

(5) Individual data transferred pursuant to subsections 2 to 4 may only be used for the purposes for which it was transferred.

(6) Individual data contained in statistical results and concerning information on legal membership (or lack thereof) in a religious community pursuant to § 2 no. 1 disaggregated by age and sex, and on the census elements listed in § 4 no. 1 lit. b disaggregated by the type of activity carried out by the workplace or company, as well as on the census elements listed in § 4 no. 3 lit. b, may be disclosed by the statistical offices of the Federation and the Länder .

[(7)-(8) …]

[…] [The Federal Statistics Act is also applicable to the proposed type of statistical data collection. Relevant provisions are:]

§ 10

(1) All natural persons and legal persons incorporated under private law, commercial partnerships, and bodies, institutions and foundations incorporated under public law, and authorities and other public bodies of the Federation, the Länder , the municipalities and municipal associations, as well as their subordinate bodies, institutions and foundations incorporated under public law over which they exercise regulatory oversight, are obliged to answer lawfully submitted questions except where answering is expressly declared optional.

(2) The obligation of census subjects to provide the requested information applies vis-à-vis the bodies and persons officially tasked with carrying out federal statistical surveys.

(3) Answers must be provided in a truthful and complete manner, within the stipulated time period and free of charge (including postal fees).

(4) Where official survey sheets to be filled in by the census subjects are provided, the requested information must be submitted on these forms. If indicated on the survey sheet, the accuracy of the information provided must be confirmed by signature.

§ 11

(1) In the absence of provisions to the contrary, individual data on personal and material circumstances provided for federal statistics purposes must be treated confidentially by the public officials, or persons of equivalent status, that are tasked with carrying out federal statistical surveys, unless the persons concerned expressly consent, in the individual case, to the sharing and disclosure of their personal data. […]

(2) The sharing of individual data between persons and bodies tasked with carrying out federal statistical surveys is permissible to the extent that is necessary for the purposes of compiling the federal statistics in question.

[(3)-(6) …]

(7) Data collected for the purposes of identifying the respective census subjects, especially names and addresses, shall be deleted as soon as knowledge of such data is no longer necessary for carrying out the relevant tasks pertaining to statistics compiled for federal purposes. Names and addresses must be stored separately from the rest of the data, and must be subject to special confidentiality protection.

[…] [The Federal Data Protection Act also applies in the absence of more specific provisions. Relevant provisions are:]

§ 5

Data confidentiality

(1) Without authorisation, persons employed in data processing pursuant to § 1(2) of this Act or acting under instruction of the persons and bodies listed in § 1(2) of this Act are prohibited from processing, disclosing, providing access to or using protected personal data for purposes other than the designated purpose pertaining to the lawful exercise of their respective functions.

(2) [...]

§ 13

Information to be provided to the data subject

(1) Upon request, the data subject concerned shall be provided with information on personal data stored about them. The request should specify the type of personal data on which information is sought. The body controlling the relevant data shall exercise due discretion in determining the applicable procedure and, in particular, the manner in which the requested information is to be provided.

(2) (...)

(3) The request by the data subject shall not be complied with if

1. providing the information sought would jeopardise the lawful performance of tasks for which the body controlling the data is responsible,

2. providing the information sought would pose a danger to public security and order, or otherwise impair legitimate interests of the Federation or a Land ,

3. a legal provision or the nature of the data requires that the personal data in question, or the fact that it is stored, be kept confidential, especially on grounds of overriding legitimate interests of third parties.

4. (...)

(4) (…)

2. After the initial attempt to introduce draft legislation on a census failed during the 8th legislative period, due to disagreement regarding costs, the Federal Government re-submitted essentially the same census draft law in early 1981. The key considerations put forward in the explanatory memorandum attached to the draft can be summarised as follows (BTDrucks 9/451, p. 7 et seq .):

Population, occupation and workplace censuses are integral to collecting statistical data. Data on updated population figures, including on regional distribution, demographic composition and social indicators as well as economic activity, is vital to decision-making on social and economic policies at the level of the Federation, the Länder and the municipalities. Various legal provisions make reference to census results. Similarly, political parties, trade unions and employers’ organisations, business and professional associations, science and research, and other relevant groups of public life rely on census results. Moreover, census results serve as the basis for updating information on ongoing developments and as the selection basis for random sample surveys provided for in other legislation. The results of the last census, which took place on 27 May 1970, are outdated. The Federation, Länder and municipalities, but also numerous social and business organisations believe that their work may be seriously impaired in the foreseeable future, and fear miscalculations in planning and investment decisions. The data to be collected for the purposes of updating existing records is limited to what is absolutely necessary, in order to ease the burden on the census subjects and to minimise costs.

The population and occupation census will provide a comprehensive overview of population structures, including a detailed regional breakdown. The results of the census will be used for numerous administrative purposes. Population figures, for example, are significant for determining the votes allocated to each Land in the Bundesrat , for delimiting constituencies for Bundestag elections, for determining the size of municipal councils and for many other matters. The Free State of Bavaria counted more than one hundred legal provisions that make reference to population figures. Comparing the residential address data collected in the census with the data of the civil registers will ensure that the population figures produced by the census, and updated continuously on its basis thereafter, will largely be identical to the content of the civil registers.

The building-related survey is primarily needed for the purposes of analysing regional and urban development, which is relevant for the entire federal territory, and will serve as a basis for the statutorily required update of housing stock records. The dwelling-related survey aims to provide a detailed regional breakdown of the volume and structure of the housing stock. This serves to establish essential indicators for evaluating the housing stock regarding, for instance, occupancy levels, or information on vacant apartments and rent to income ratios. At the same time, such data provides the basis for statutorily required updates of housing stock records.

As an umbrella survey, the workplace census covers all economic sectors, except for the agricultural sector. Breaking down the data by sector and region, the census will provide an overview of the number and size of workplaces and companies and their respective legal forms. The results of the census will provide valuable information, most notably in relation to spatial, Land and regional planning, as well as in relation to structural, labour and transport policies.

[…]

[Upon receiving the legislative draft adopted by the Bundestag ], the Bundesrat requested, firstly, that § 5(2) of the 1983 Census Act be inserted into the draft law; according to this provision, neither an objection in administrative proceedings nor a rescissory action before the administrative courts (Anfechtungsklage ) upon receiving the official demand to provide information has suspensive effect. In its reasoning, the Bundesrat submitted that the costs of the census would only be justified if complete data were available within the shortest time possible. This objective would be jeopardised if legal remedies were to have suspensive effect. It would be difficult to establish sufficient grounds for issuing orders for immediate execution in each individual case [in accordance with the general rules of administrative procedure]. The Bundesrat stated that this uncertainty could be avoided if the law itself prescribed that the suspensive effect of legal remedies did not apply.

In addition, the Bundesrat submitted that it was necessary to include, in its entirety, all data obtained pursuant to § 2 nos. 1 and 2 of the 1983 Census Act in the envisaged comparison of census data with civil register records. […]

[…]

II.

The complainants claim a violation of their fundamental rights under Art. 2(1) in conjunction with Art. 1(1), Art. 4(1), Art. 5(1), Art. 13 and Art. 19(4) of the Basic Law as well as a violation of the principle of the rule of law (Art. 20(3) of the Basic Law). [...]

[…]

III.

[…]

In respect of the constitutional complaints and the questions posed by the Federal Constitutional Court in these proceedings, the Federal Minister of the Interior submitted a statement on behalf of the Federal Government; further statements were submitted by the Land Government of Baden-Württemberg, the Government of the Free State of Bavaria, the Government of the Free and Hanseatic City of Hamburg, the Land Government of Lower Saxony, the Land Government of North Rhine-Westphalia, the Land Government of Rhineland-Palatinate and the Land Government of Schleswig-Holstein. In addition, statements were submitted by the Federal Data Protection Officer as well as by the Data Protection Officers of the Länder Baden-Württemberg, Bavaria, Berlin, Bremen, Hamburg, Hesse and North Rhine-Westphalia and by the Data Protection Commission of the Land Rhineland-Palatinate.

[…]

IV.

The complainants [and the other parties to the proceedings as well as experts] were heard in the oral hearing.

[…]

B.

The constitutional complaints are, for the most part, admissible.

In accordance with established case-law, a universally applicable legal provision may be challenged directly by individual citizens only in the event that the relevant legal provision affects them individually, presently and directly with regard to their fundamental rights (BVerfGE 40, 141 <156>; 43, 291 <385>; 50, 290 <319>; 58, 81 <104>; 59, 1 <17 and 18>; 60, 360 <370>).

I.

[…]

II.

To the extent that the complainants are individually affected by the 1983 Census Act, they are also directly and presently affected.

According to the case-law of the Federal Constitutional Court, a complainant is not directly affected by a challenged law if implementation of the law requires specific measures to be taken by the administrative authorities. This is because the interference with the citizen’s legal sphere only occurs through the relevant implementation measure; legal recourse against this interference also allows for a challenge of the constitutionality of the law on which the measure was based (BVerfGE 58, 81 <104>; cf. BVerfGE 59, 1 <17>; 60, 360 <369 and 370>).

In order to implement the 1983 Census Act, a demand to provide information would have had to be issued; the legal sphere of the complainants would only have been affected upon receiveing such a demand […]. At that point, recourse to the administrative courts against this implementation measure would have become possible. Yet this does not rule out the admissibility of the constitutional complaints in the current proceedings.

In certain constellations, the Federal Constitutional Court has, by way of exception, accepted constitutional complaints directly challenging a law as admissible even though specific implementation measures had yet to be taken; this requires that the law itself already compels the persons concerned to presently make decisions that cannot be reversed at a later date, or to make arrangements with consequences that cannot be undone once the implementation measures provided for under the relevant law have been carried out (BVerfGE 60, 360 <372> with further references). Accordingly, the constitutional complaints that directly challenge the 1983 Census Act are admissible by way of exception even though specific implementation measures have yet to be taken.

Notably, the Act was supposed to be enforced vis-à-vis all citizens within a very short period of time. […]

C.

To the extent that they are admissible, the constitutional complaints are in part well-founded.

I.

Insofar as § 5(1) of the 1983 Census Act directly imposes an obligation upon the complainants to provide information on specific subject matters enumerated in §§ 2 to 4 of the Act, there is no violation of the complainants’ fundamental rights under Arts. 4, 5 and 13 of the Basic Law.

1. The obligation to provide truthful information [...] on legal membership (or lack thereof) in a religious community [...] does not violate the complainants’ fundamental right to freedom of faith (Art. 4(1) of the Basic Law). Freedom of faith encompasses not only the right to profess one’s religious beliefs, but also the right not to disclose one’s beliefs, as is specifically recognised in Art. 140 of the Basic Law in conjunction with Art. 136(3) of the Weimar Constitution. The negative freedom not to profess a belief is limited, however, by the exception set forth in Art. 136(3) second sentence of the Weimar Constitution: according to this provision, authorities have the right to inquire about a person’s membership in a religious community to the extent that citizens’ rights or duties depend on it or that a statutorily mandated statistical survey so requires. Given that the census constitutes a statutorily mandated statistical survey for federal purposes (Art. 73 no. 11 of the Basic Law), the prerequisites of a permissible exception are met in the present case.

[…]

2. Moreover, the 1983 Census Act does not violate the fundamental right to the inviolability of the home (Art. 13(1) of the Basic Law).

Contrary to what some of the complainants submitted, the obligation imposed on them to disclose information on their private housing situation, as provided for in § 3(2) in conjunction with § 5(1) no. 3 of the 1983 Census Act, does not violate this fundamental right. For the purposes of Art. 13 of the Basic Law, the term ‘home’ refers only to the sphere of private space within one’s home (BVerfGE 32, 54 <72>). This fundamental right subjects public authority to a general prohibition barring officials from entering a private home, and from being present there, against the will of the resident. This prohibition covers, for example, the installation or use of listening devices within private homes; however, it does not extend to collecting or requesting information where such information is obtained without entering or being present in the home. In such cases, Art. 13 of the Basic Law is not applicable. [...]

3. The obligation to provide information on the subject matters listed in §§ 2 to 4 of the 1983 Census Act also does not violate the fundamental right to freedom of expression (Art. 5(1) first sentence of the Basic Law).

[…]

For determining whether a statement qualifies as an opinion and thus falls within the scope of protection guaranteed by that fundamental right, the decisive issue is whether the statement contains elements of taking a position, of condoning or of opining as part of an intellectual discourse; the value, accuracy or reasonableness of the statement in question is irrelevant. [...] By contrast, information provided for statistical purposes such as the collection of data under the 1983 Census Act contains mere factual statements that bear no relation to the formation of opinions.

II.

The applicable standard of review here derives primarily from the general right of personality protected under Art. 2(1) in conjunction with Art. 1(1) of the Basic Law.

1. a) The value and dignity of the person, acting in free self-determination as a member of a free society, are at the centre of the Basic Law. In addition to the constitutional guarantees laid down in specific freedoms, the general right of personality, guaranteed in Art. 2(1) in conjunction with Art. 1(1) of the Basic Law, serves to protect these interests; this protection may gain even more significance in light of modern developments that pose new risks to one’s personality (cf. BVerfGE 54, 148 <153>). The different dimensions of the right of personality that have so far been recognised in the Court’s case-law do not exhaustively define the substance of this right. In the Eppler decision (BVerfGE 54, 148 <155>), which draws on earlier cases (BVerfGE 21, 1 <6>; 27, 344 <350 and 351>; 32, 373 <379>; 35, 202 <220>; 44, 353 <372 and 373>), it was already implied that, based on the notion of self-determination, the general right of personality confers upon the individual the authority to, in principle, decide themselves whether and to what extent to disclose aspects of their personal life (cf. also BVerfGE 56, 37 <41 et seq .>; 63, 131 <142 and 143>).

Given the present and future realities of automatic data processing, this authority conferred upon the individual merits special protection. Most notably, risks arise because decision-making processes that in the past required records and files to be compiled manually can now rely on automatic data processing. As a result, specific information concerning the personal or material circumstances of an identified or identifiable individual (i.e. personal data, cf. § 2(1) of the Federal Data Protection Act) can be stored indefinitely, from a technical perspective, and retrieved at any time within seconds, without distance being an issue. In addition, the data in question can be compared with data collected from other sources, especially by creating integrated information systems, and can be compiled into partial or practically complete personality profiles, leaving the person concerned without sufficient control over the accuracy or use of the data stored on them. This has expanded possibilities of gaining and influencing information to unprecedented levels, so that even the mere psychological pressure created by public perception may potentially impact individual behaviour.

Yet it is a prerequisite for individual self-determination – especially in light of modern information technology – that the individual be afforded the freedom to decide whether to take or refrain from certain actions, including the possibility to actually conduct themselves in accordance with this decision. If individuals cannot, with sufficient certainty, determine what kind of personal information is known to certain parts of their social environment, and if it is difficult to ascertain what kind of information potential communication partners are privy to, this could greatly impede their freedom to make self-determined plans or decisions. A societal order, and its underlying legal order, would not be compatible with the right to informational self-determination if citizens were no longer able to tell who knows what kind of personal information about them, at what time and on which occasion. Individuals who worry that non-conformist behaviour could be recorded at any time and that such information could permanently be stored, used or shared will try not to draw attention to themselves by not engaging in such behaviour. If individuals anticipate that participation in an assembly or a citizens’ initiative, for instance, was going to be recorded by the authorities and could thus expose them to certain risks, they might decide to forgo the exercise of their respective fundamental rights (Arts. 8 and 9 of the Basic Law). Not only would this impair opportunities of personal development for the individual, it would also affect the common good because self-determination is a fundamental prerequisite for the functioning of a free and democratic society which relies on the agency and participation of its citizens.

In the context of modern data processing, the free development of one’s personality therefore requires that the individual be protected against the unlimited collection, storage, use and sharing of their personal data. Consequently, the fundamental right of Art. 2(1) in conjunction with Art. 1(1) of the Basic Law encompasses such protection. In this regard, the fundamental right confers upon the individual the authority to, in principle, decide themselves on the disclosure and use of their personal data.

b) The right to ‘informational self-determination’ is not, however, guaranteed without limitation. It does not afford the individual absolute or unlimited control over ‘their’ personal data; rather, the individual develops their personality within the social community, and is dependent on communication with others. Any information, including personal data, mirrors social reality and thus cannot be attributed exclusively to the person concerned. As repeatedly emphasised in the Court’s case-law, the Basic Law resolves the tension between the individual and the community by endorsing the notion that the individual is connected to and bound by the community (BVerfGE 4, 7 <15>; 8, 274 <329>; 27, 1 <7>; 27, 344 <351 and 352>; 33, 303 <334>; 50, 290 <353>; 56, 37 <49>). The individual must therefore accept that the right to informational self-determination is, in principle, subject to restrictions serving overriding public interests.

Pursuant to Art. 2(1) of the Basic Law […] such restrictions require a (constitutional) statutory basis specifying the prerequisites and scope of the restrictions in a manner that is clear and recognisable to citizens in accordance with the principle of legal clarity deriving from the rule of law (BVerfGE 45, 400 <420> with further references). Furthermore, when enacting restrictions, the legislator must observe the principle of proportionality. This principle, which enjoys constitutional status, derives from the essence of fundamental rights; it is a manifestation of the general claim to freedom that citizens have vis-à-vis the state; public authority may only restrict such freedom to the extent that is absolutely necessary for protecting public interests. In view of the risks arising from the use of automatic data processing outlined above, it is incumbent upon the legislator to provide for organisational and procedural safeguards that counter the risk of violating the right of personality (cf. BVerfGE 53, 30 <65>; 63, 131 <143>).

2. In the present constitutional complaint proceedings, there is no need to discuss the right to informational self-determination in an exhaustive manner. The Court is only called upon to decide on the scope of this right in relation to interferences that arise when the state demands that citizens disclose personal data. In this context, it is not sufficient to simply assess what kind of information is being demanded. The decisive factor is how the data may be used, and for what purposes. On the one hand, this depends on the purposes for which the data is collected; on the other hand, the unique possibilities created by information technologies with regard to the processing and linking of data must be taken into account. Therefore, data that by itself appears insignificant may gain new relevance; in the context of automatic data processing, it can therefore no longer be assumed that any data is insignificant.

Qualifying data as sensitive is not solely dependent on whether the relevant data concerns intimate matters. Rather, knowledge of the relevant context in which the data will be used is necessary to determine its significance for the right of personality: whether a restriction of the right to informational self-determination is permissible can only be assessed once it is clear for what purposes the relevant information has been demanded and what possibilities exist with regard to using and linking the data obtained. In this regard, a distinction must be made between personal data that is collected and used in the form of individualised information that has not been rendered anonymous (see a below), and personal data that is intended for statistical purposes (see b below).

a) It is well-established that the mandatory collection of personal data is only permissible within certain limits; this applies, most notably, if the data is collected for purposes pertaining to the exercise of public functions (for instance concerning taxes or social benefits). In this regard, the law has already put in place various mechanisms for the protection of the persons concerned [...].

Imposing an obligation to provide personal data requires that the legislator specify precisely, for each subject matter, the purposes for which the data may be used; furthermore, the information obtained must be suitable and necessary for achieving these purposes. The gathering and retention of data that has not been rendered anonymous for undefined or yet to be defined purposes would not be compatible with these principles. In addition, it is imperative that data collected by public bodies for the purpose of exercising their functions be limited to what is necessary for achieving the objective pursued.

Data may only be used for statutory purposes. Not least in light of risks arising from automatic data processing, it is necessary to provide protection against use of the data for other purposes, by way of statutory prohibitions regarding data sharing and further use, including protection against use of the data in the context of inter-agency administrative assistance (Amtshilfe ). Other essential procedural safeguards include notification, information and deletion requirements.

Due to the lack of transparency regarding data storage and use from a citizen’s perspective in the context of automatic data processing, it is particularly important to involve independent data protection officers in order to ensure effective protection of the right to informational self-determination; this also serves to ensure preventive legal protection by means of timely precautions.

b) With regard to the collection and processing of data for statistical purposes, constitutional review must not disregard the specific nature of statistics.

aa) Statistics play a pivotal role in ensuring that public policy remains committed to the principles and rationale of the Basic Law. The availability of comprehensive, continuous and regularly updated information on economic, ecological and social factors is a prerequisite for pursuing economic and social development as a lasting [state] responsibility, as opposed to surrendering to the perceived inevitabilities of fate and happenstance. It is only through knowledge of the relevant data and through the possibility of using the information obtained from it for statistical purposes that a basis for action is created which is indispensable for public policy guided by the principle of the social state (cf. BVerfGE 27, 1 <9>).

The collection of data for statistical purposes cannot be subject to a strict and specific purpose limitation. It is inherent in the nature of statistics that data processed for statistical purposes is intended to be used for a variety of tasks that cannot necessarily be determined in advance; therefore, it is necessary to retain certain data. The requirement that the purposes of data collection and use be precisely defined, as well as the strict prohibition on retaining personal data, are both applicable to data collection for non-statistical purposes; however, they do not apply to the collection of census data which, by producing reliable data on population and social demographics, serves to establish a verified data pool as the basis for further statistical analysis and political planning processes. The population census must necessarily allow multi-purpose data collection and multi-purpose data use, i.e. the gathering and storage of data for further retention, so as to not leave the state utterly unprepared to face new developments within an industrial society. Similarly, in relation to statistical data, statutory prohibitions on data sharing and other uses would undermine the purpose of statistics.

bb) Accordingly, it is inherent in the nature of statistics that the numerous possibilities of how such data can be used and linked are not ascertainable in advance. Therefore, the collection and processing of information within such information systems must be subject to certain limitations. Clearly defined conditions for the processing of data must be established in order to ensure that the individual is not reduced to a mere information object, given the realities of automatic collection and processing of their personal data. [...] It is precisely because data collected during population censuses is not from the outset restricted by purpose-related limitations that censuses tend to entail a risk, as already emphasised in the Microcensus decision (BVerfGE 27, 1 <6>), of registering and cataloguing the individual in a manner that violates personality rights. Therefore, data collection and processing for statistical purposes must be subject to specific requirements to protect the right of personality on the part of citizens obliged to provide information.

Notwithstanding the fact that data collection and processing for statistical purposes inherently have multiple functions, they may only be employed as a means to facilitate the exercise of public functions. Even then, not any type of information may be requested. Also, when imposing obligations to provide specific information needed for statistical purposes, it is incumbent upon the legislator to assess, in particular, whether this could create a risk of social stigmatisation for the persons concerned (e.g. by branding people as drug addicts, convicts, mentally ill, social misfits), and whether the statistical objective could just as well be achieved by means of collecting anonymous data. [...]

Furthermore, in order to ensure that respect the right to informational self-determination is respected, specific safeguards must be put in place concerning the implementation and organisation of data collection and processing. This is due to the fact that at the stage of collection – and in part also during storage – such data can still be attributed to individual persons. It is also necessary to impose statutory deletion requirements with regard to data collected as auxiliary information (identification markers) such as name, address, identification number and census list number that would easily allow for anonymisation to be reversed (cf. also § 11(7) first sentence of the Federal Statistics Act). In respect of statistical surveys, an effective regime on shielding data against external access is of particular importance. As long as the relevant data is still attributed or attributable to a person, it is indispensable for the protection of the right to informational self-determination that individual data collected for statistical purposes be treated as strictly confidential (principle of statistical confidentiality), even at the stage of data collection; the same holds true for the requirement that data be rendered (effectively) anonymous as soon as possible and that safeguards against reversing anonymisation be put in place.

Statutory requirements that data be rendered anonymous and, as long as the information is still attributable to individuals, treated confidentially derive from the right to informational self-determination and must be laid down in the law; only once data has been shielded in this manner may state organs access the information that is necessary for carrying out public planning functions. An obligation to provide the requested information may be imposed on citizens only where these requirements are met. If personal data collected for statistical purposes could be shared against the will or without the knowledge of the affected person, this would restrict the constitutionally protected right to informational self-determination in an impermissible manner; it would also jeopardise the official statistics provided for in Art. 73 no. 11 of the Basic Law, which that provision recognises as an interest meriting protection. It is imperative for the proper functioning of official statistics to ensure a high level of accuracy and veracity. This objective will only be achieved if citizens obliged to provide information can trust that their personal data collected for statistical purposes will be sufficiently shielded; otherwise, citizens might not be inclined to provide truthful information […]. If state practice did not endeavour to build the necessary public trust by ensuring transparency in data processing procedures and strict data protection regimes, distrust among the general public would eventually lead to a decline in the willingness to cooperate. [...] It follows that the state can only carry out its policy planning function properly if statistical data is sufficiently shielded; accordingly, the principle that the relevant data be treated confidentially and rendered anonymous as soon as possible is integral not only to protecting the right to informational self-determination afforded individuals under the Basic Law but also to the functioning of statistics as such.

cc) If the requirements set out above are met in an effective manner, then based on the current state of knowledge and experience, the collection of data for strictly statistical purposes is not objectionable under constitutional law. It is not ascertainable that the citizens’ right of personality would be impaired if statistics offices shared data with state organs or other public bodies [...] after the relevant data has been rendered anonymous or processed for statistical analysis.

Yet particular problems arise if personal data is transferred (data sharing) before such data has been either rendered anonymous or processed for statistical analysis. The collection of data for statistical purposes includes individualised information on individual citizens that is not specifically required for the relevant statistics but merely serves as an auxiliary means to facilitate the data collection process – and citizens must be able to trust that this data will indeed only be used in that auxiliary capacity. [...] Where data collected for statistical purposes is shared with other authorities for the purposes of carrying out administrative functions, and such transfer occurs before the data has been rendered anonymous or processed for statistical analysis, this may [...] unlawfully interfere with the right to informational self-determination (cf. also C IV 1 below).

III.

For the most part, the data collection framework provided under the Census Act satisfies the constitutional requirements set out above. [...] The provisions are compatible with the general right of personality under Art. 2(1) in conjunction with Art. 1(1) of the Basic Law, provided that the legislator enacts additional organisational and procedural rules for the protection of fundamental rights in order to remedy the existing deficits; this is necessary to ensure that the constitutional requirements applicable to the type of full census envisaged under the 1983 Census Act are adhered to.

1. The 1983 Census Act imposes an obligation [...] on the complainants [...] to provide information regarding [specific] census elements [...] and makes non-compliance punishable by fine. The Census Act thus interferes with the general right of personality guaranteed under Art. 2(1) in conjunction with Art. 1(1) of the Basic Law. The data to be collected in the census is intended to be used for future tasks that are not foreseeable at the time the census takes place. The resulting interference [with informational self-determination] must be tolerated by the census subjects. The interference serves an overriding public interest and satisfies the requirements of legal clarity and proportionality.

a) The data collection framework laid down in the 1983 Census Act does not amount to the registration or cataloguing of full or partial personality profiles in a manner that is incompatible with human dignity.

According to the explanatory memorandum attached to the Federal Government’s draft law, the envisaged population, housing, occupation and workplace census [...] is intended to provide up-to-date information on the population as well as on its regional, demographic and social breakdown and on economic activity; in consequence, the census is ultimately designed to produce de-personalised data.

While the envisaged data collection may provide insights into certain aspects of citizens’ lives, such as their housing situation, the collected data cannot be used to compile personality profiles. A different assessment would only be merited if it were possible to link the collected data to (in part rather sensitive) data records maintained by other administrative authorities, or if it were possible to establish such a data network by way of introducing a uniform system of personal identifiers or some other kind of structural markers; even where data collected for statistical purposes is rendered anonymous, it is still not permissible to carry out a comprehensive registration and cataloguing of individuals’ personality by means of compiling personality profiles of the citizens concerned on the basis of their biographical and personal data (BVerfGE 27, 1 <6>). [...]

The compilation of data collected for the 1983 Census and its comparison with information that is already available to the statistical offices does not enable the creation of partial personality profiles in a manner that is incompatible with human dignity. [...]

b) Moreover, the data collection framework of the 1983 Census Act satisfies the requirement of legal clarity.

A law is sufficiently specific if its purpose is ascertainable from the text of the law read together with the relevant legislative materials (BVerfGE 27, 1 <8>); in this respect, it is sufficient if the purpose of the law can be discerned from the relationship between the legal text and the factual context of its subject matter (cf. BVerfGE 62, 169 <183 and 184>). The descriptions contained in the 1983 Census Act regarding the census elements on which data is to be collected satisfy these requirements; it is possible for citizens to identify the basic type of information on social structure they will be required to answer. The main purposes of the Act can be derived with sufficient certainty from the nature of the envisaged data collection – a census of population, occupation, housing and workplaces – as well as from the data collection framework and the relevant legislative materials. [...]

c) To the extent that the data collection framework laid down in the 1983 Census Act is subject to review in the current proceedings, it satisfies the principle of proportionality. Under the principle of proportionality, a measure must be suitable and necessary for the purpose pursued; the intensity of the interference which it entails may not be disproportionate to the importance of the matter and the burden imposed on the individual (cf. BVerfGE 27, 344 <352 and 353>; established case-law).

The 1983 Census Act aims to provide the state with the information required for future planning and action. By ensuring that state action can be properly planned (cf. BVerfGE 27, 1 <7>), the 1983 Census Act pursues a reasonable purpose that serves the exercise of legitimate state functions.

By choosing to conduct the population census in the form of a full census (complete data collection), and with the envisaged catalogue of survey questions [...], the Federal Republic of Germany fulfils its obligation arising from the Directive of the Council of the European Communities of 22 November 1973 on the synchronisation of general population censuses – 73/403/EEC [...]. The data collection method and framework are suitable and necessary to achieve the purpose pursued; moreover, they do not impose unreasonable burdens on the census subjects.

aa) At present, it is not objectionable that the legislator assumed that neither the collection of data by way of a sample survey conducted on a strictly voluntary basis nor a combination of a full survey and a sample survey could adequately substitute a population census in the form of a full census. These alternatives to full census surveys still entail too many sources of error. [...]

This assessment is based on the current state of knowledge and experience. [...] The methods used in official statistics and social sciences are constantly evolving. The legislator must take account of these developments. [...] When circumstances change, the legislator may be required to amend provisions that were previously considered constitutional (cf. BVerfGE 56, 54 <78 and 79> with further references). Thus, when prescribing the collection of statistical data, the legislator must assess, based on available information, whether a full census can still be considered proportionate despite possible advances in the methods used in statistics and social sciences.

[...]

bb) Retrieving data from existing administrative records is also not a viable alternative to the envisaged full census. Using data contained in different registers and records would require technical, organisational and legal measures to allow the compiling of data relating to specific persons or institutions. [...] In light of this, linking existing data would also not constitute a less restrictive means.

cc) Similarly, using data collection methods that are commonly employed for electoral and voting purposes, i.e. methods that are modelled on postal voting procedures and thus provide a higher level of anonymity, do not generally provide an alternative to the envisaged census.

[…]

dd) The census elements [...] are also necessary in their entirety in order to achieve the purpose pursued. The census is intended to provide, in a detailed and coordinated manner, a comprehensive statistical assessment of society and the economy. To this end, it is necessary to obtain and link data from each census segment, i.e. the population census and the occupation census as well as the building, dwelling and workplace censuses. […]

2. At the same time, in order to ensure protection of the right to informational self-determination, it is imperative that additional procedural safeguards be put in place concerning the implementation and organisation of the data collection. The data collection envisaged under the 1983 Census Act only in part satisfies the constitutional requirements (see C II 2 bb above). It is true that the Census Act sets out provisions on the requirement that data collected for statistical purposes be treated confidentially, protecting the fundamental right to informational self-determination. Moreover, the Act requires that any data used to identify census subjects be deleted as soon as it is no longer needed for federal statistical purposes. [...] These provisions do not suffice, however, to ensure that the data collection and processing in the envisaged census is carried out in line with constitutional requirements. Rather, it is incumbent upon the legislator to amend the existing framework by putting in place necessary safeguards for the protection of the right to informational self-determination. While the legislator is not required to determine all the details itself, it must nevertheless ensure that the necessary measures are taken. In particular, the following measures are required to ensure fundamental rights protection:

a) Census subjects must be notified and informed of their rights and duties. As the law stands, they can object to having their data collected jointly with other persons living in the same household; if they prefer, they may request that their data be collected on a separate survey sheet […]. In addition, the census subjects have the right […] to give a sealed envelope containing the completed survey sheet to the census officials, submit it to the census office, or send it in by post. In case of mass surveys like the envisaged census, however, it is generally difficult for citizens to know their rights [...]. Therefore, it is incumbent upon the legislator to ensure that citizens are informed about their rights in writing. It must also be clearly indicated that certain types of information (telephone numbers, for instance) are merely collected on a voluntary basis.

b) Information used to identify census subjects (especially name, address, identification number and census list number) must be deleted as soon as possible; prior to deletion, this data must be treated confidentially and kept separate from the rest of the data. The application of these rules [...], which serve to protect fundamental rights, may not be left entirely to the discretion of the administrative authorities. It must also be ensured that the responsible data protection officer exercise effective oversight. [...]

c) Data subjects interact with census officials, who may obtain knowledge of the information provided in the census documents if the survey sheet is not sealed in an envelope. Therefore, measures must be taken to prevent conflicts of interests to the greatest possible extent. […] Data protection officers have rightly [...] pointed out that officials should not be assigned census duties when a conflict of interest cannot be ruled out. As an additional measure of protection, the law must state that census officials [...] may not be deployed in the immediate proximity of their homes so as not to affect residents’ willingness to cooperate in the relevant neighbourhoods.

d) Finally, the legislator must ensure that the contents of the questionnaire used in the census actually comply with the statutory framework. [...]

IV.

1. As set out above (see C II 2 cc), data collected for statistical purposes that has not yet been rendered anonymous and thus still qualifies as personal data may only be shared if there is a statutory basis expressly authorising such data sharing. Furthermore, the sharing of such data is only permissible for the purposes of statistical processing by the receiving administrative authority and on condition that necessary safeguards for protecting the right of personality have been put in place. In this respect, it must be effectively ensured that the receiving authority observes the requirements that data collected for statistical purposes be treated confidentially and rendered anonymous as soon as possible; the level of protection required of the receiving authority must be equal to the level of protection required of the statistical offices of the Federation and the Länder . By contrast, it would constitute an unjustifiable interference with the right to informational self-determination if personal data collected for statistical purposes in accordance with the relevant statutory basis were to be shared, without being rendered anonymous, for purposes pertaining to the exercise of administrative functions (use of data for unauthorised purposes). [...]

A legal framework [...] designed to simultaneously achieve both statistical and other purposes is in any case unsuitable and unconstitutional where it seeks to combine what is generally incompatible. Where a census law combines statistical purposes with purposes of exercising administrative functions, this may undermine its legal clarity and comprehensibility; it also renders the relevant law disproportionate. If data is not collected exclusively for statistical purposes, it is imperative that the sharing and use of such data be subject to strict and specific purpose limitations (see C II 2 a above). In addition, the principle of legal clarity is of particular importance. The applicable legal provisions must make it clear to citizens that their data will not be used exclusively for statistical purposes; that their data will be used for other specific purposes related to the exercise of administrative functions for which use of their data is necessary; that use of their data will remain limited to the specified purposes; and that the law affords them protection against self-incrimination in this context.

2. The envisaged combination of collecting census data for statistical purposes and for comparing it with civil register data [...] does not meet these constitutional requirements.

a) […]

b) § 9(1) of the 1983 Census Act violates the right to informational self-determination guaranteed under Art. 2(1) in conjunction with Art. 1(1) of the Basic Law, given that the provision seeks to combine what is generally incompatible; the provision is therefore unsuitable to the purpose pursued and lacks legal clarity regarding its content so that, from the perspective of citizens, its implications are not fully comprehensible.

§ 9(1) first sentence of the 1983 Census Act authorises municipalities to compare the data provided in the census documents with the data contained in their civil register records and to then use the census data to correct the latter. Selected personal data collected in the 1983 Census may thus not only be used for statistical purposes but also for purposes related to the exercise of administrative functions, which means that no specific purpose limitations apply. [...] Due to the fact that the registration offices are in turn obliged [...] to share their data with other authorities, [...] it is not foreseeable for which specific purposes and by which public authorities the data would be used. [...]

The legislator was aware of the degree to which combining the two different purposes could significantly jeopardise the proper functioning of official statistics, which is essential for statistical data collection [...]; consequently, the legislator laid down an express prohibition in § 9(1) second sentence of the 1983 Census Act against using individual information collected for statistical purposes as the basis for state measures directed against the relevant census subject. Yet this prohibition of using data to the detriment of census subjects falls short. It cannot compensate the deficits in the proper functioning of official statistics and the protection of the persons concerned that result from the combination of statistical purposes and purposes of exercising administrative functions. […]

3. § 9(2) of the 1983 Census Act also violates Art. 2(1) in conjunction with Art. 1(1) of the Basic Law. This provision authorises the transfer of certain personal data to the competent highest administrative authorities at the level of the Federation and the Länder , as well as to other public bodies designated by such authorities, to the extent that the receiving body requires the relevant data for the lawful exercise of its respective official functions. The data sharing authorised under the Census Act exceeds the scope of [existing statistics laws], as it allows all data to be shared, excluding only names [...] and information on membership in religious communities (or lack thereof); in consequence, there is little difficulty in attributing the relevant data to the individual concerned. In this respect, the Census Act does not specify whether the sharing of data is only allowed for statistical purposes or also permissible for exercising administrative functions. [...] In any case, § 9(2) of the 1983 Census Act already violates the right to informational self-determination of citizens because it is not clearly ascertainable whether the provision even authorises the data sharing for administrative purposes, nor does the law set out clearly defined purposes for the use and sharing of the collected data, despite the fact that this would be required under constitutional law as long as the relevant data has not been rendered anonymous. […]

4. Similarly, § 9(3) of the 1983 Census Act violates Art. 2(1) in conjunction with Art. 1(1) of the Basic Law.

a) This provision provides that personal data (excluding names) collected with the help of municipalities may be shared for certain administrative purposes at the municipal level. The provision permits the sharing of specific (personal) data that is required [...] for purposes relating to regional planning, surveying, municipal planning and environmental protection. It is not sufficiently clear, however, for what specific purposes data may be shared; it is unclear, in particular, whether these purposes are limited to statistics or also extend to the exercise of administrative functions. [...] Consequently, § 9(2) of the 1983 Census Act already violates the general right of personality guaranteed under Art. 2(1) in conjunction with Art. 1(1) of the Basic Law due to the fact that the provision clarifies neither whether personal data that is shared may also be used for the purposes of exercising administrative functions nor what specific and clearly defined purposes would be concerned. [...]

b) [...]

5. In contrast, § 9(4) of the 1983 Census Act does not violate the general right of personality. This provision states that certain personal data may, for scientific purposes, be shared with public officials or persons of equivalent status. The data shared for scientific purposes must be limited to what is necessary; under no circumstances may the data include names or addresses. The provision thus recognises that in most fields of research it is not necessary to directly link the relevant data to a specific person, as scientists are generally not interested in the individual person [...].

V.

[…]

VI.

1. Given that § 9(1) to (3) of the 1983 Census Act is not compatible with the Basic Law and violates the complainants’ fundamental rights under Art. 2(1) in conjunction with Art. 1(1) of the Basic Law, these provisions are declared void pursuant to § 95(3) first sentence of the Federal Constitutional Court Act. Exceptional grounds on the basis of which it would be permissible to forgo declaring the relevant provisions void are not ascertainable in the current proceedings.

2. […]