Summary:

I.

On 23 November 2001, the Federal Republic of Germany signed the Council of Europe 2008 Convention on Cybercrime (hereinafter: the Convention). Upon approval by Parliament (Bundestag) pursuant to the first sentence of Article 59.2 of the Basic Law, the Convention entered into force in Germany on 1 July 2009. In their constitutional complaint, the applicants challenged some provisions of the German Act of Assent to the Convention. Those provisions concern international mutual assistance. They implement Articles 25 to 34 of the Convention. The applicants asserted that Articles 1.1., 2.1 in conjunction with 1.1, Articles 10, 13, 19.4., 101, 102, and 104 of the Basic Law had been violated.

II.

The Federal Constitutional Court held that the constitutional complaint was inadmissible.

The decision is based on the following considerations:

Without implementing legislation, international treaties are only in exceptional cases directly applicable in the German legal order in the sense that they directly create legal effects in the same way as national legal provisions do.

Without implementing legislation, international treaty provisions can only be directly applicable if they feature all the characteristics that a law must have under national law to create rights and obligations for its addressees.

While German law, if possible, is to be interpreted in accordance with the principle of the Constitution’s openness to international law, the limits of such interpretation are set by the German Constitution. Therefore, the principle of openness to international law cannot require the courts to interpret and apply the law in a way that is incompatible with the Constitution.

The right to informational self-determination (Article 2.1 of the Basic Law in conjunction with Article 1.1 of the Basic Law) encompasses the protection of any individual against unlimited collection, storage, use and transfer of personal data. Generally, individuals have the right to decide themselves on the disclosure and the use of their personal data.

However, as a rule, the state is not prohibited from taking note of data that is publicly available, including personal data. Therefore, if a state body collects communication content available online and addressed to the general public or at least to an audience that is not further defined, it does not interfere with the right to informational self-determination. An interference with that right is possible only where information obtained from content that is publicly available is specifically collected, stored and analysed, consulting further data where necessary, and thereby gains an additional meaning from which results a specific risk situation for the personality of the person concerned.

Factually, it follows from access by foreign states to computer data stored in Germany that the guarantees provided under the Constitution are not applied as such to further use of such data abroad, in particular regarding its storage and targeted analysis, which might also involve the consultation of further data; instead, the standards applicable abroad are applied.

Nevertheless, public authority is not as such prohibited from authorising foreign states to access publicly available data, as the German Constitution is open to international cooperation. This includes cases in which foreign legal systems and rules do not entirely correspond to the German legal system.

With regard to Articles 25 to 31, 33 and 34 of the Convention, the applicants did not meet the admissibility requirement of being directly affected, as the articles of the Convention mentioned-above were not self-executing. This already follows from the wording of the relevant provisions, which only places obligations on the Contracting Parties, not on their citizens. In addition, in describing the methods of cooperation between the states in mutual assistance matters, Article 23 of the Convention does not mention direct applicability of the Convention in the Contracting States as a possible tool; instead, Article 25.2 of the Convention provides that each Party is to adopt such legislative or other measures as may be necessary to carry out their obligations. Thus, the Parties’ understanding was that implementing measures were required. A systematic interpretation of the relevant provisions also yields such a result: According to the wording of the corresponding provisions on procedural and substantive criminal law, in particular Articles 16 seqq. of the Convention, they also require implementation. Furthermore, the object and purpose of the Convention also argues against direct applicability of the Convention: It can be deduced from the Explanatory Report to the Convention that the Contracting Parties deliberately did not create a general new mutual assistance regime with the intention of allowing for the use of already existing and well-established tools. In addition, the content of Articles 25 to 31, 33, and 34 is not sufficiently specific to be self-executing. Standing to lodge a constitutional complaint does not follow from the fact that national law is to be interpreted, where possible, in accordance with the international obligations of the Federal Republic of Germany either.

With regard to Article 32 of the Cybercrime Convention, the applicants could validly claim to be directly affected, as foreign states may directly access data stored in Germany pursuant to and in accordance with the conditions set out in Article 32 of the Convention. No German implementing act, which could be challenged before the German courts, exists in this respect. In addition, the applicants will usually not gain knowledge of data access by foreign state authorities and therefore will not be able to challenge them. However, the applicants did not demonstrate sufficiently plausibly that a violation of their fundamental rights was possible. With regard to Article 32.a of the Convention, which concerns publicly available data, they either did not – or not in sufficient detail – discuss the differences between access to data and further use of data in the context of a possible violation of the right to informational self-determination. With regard to Article 32.b of the Convention, which covers the cases in which the competent person consents to transfer of stored data, the applicants did not submit that and to which extent foreign authorities might interfere with fundamental rights.

III.

Justice Huber submitted a separate opinion. In his view, the constitutional complaint was both admissible and well-founded with regard to Article 32.a of the Convention. According to him, this article constituted an unconstitutional authorisation for foreign states to interfere with the right to informational self-determination. He held that while the collection of publicly available data by those wielding German public authority does not as such interfere with that right, a legal basis is required where it does. In his opinion, as a rule, such an authorisation to interfere with fundamental rights can be accorded to German state organs; in addition, the exercise of sovereign powers can be transferred to supra - and international organisations. In his view, however, sovereign powers cannot be transferred to foreign states.

He emphasised that the constitutional organs’ obligation to protect also applies in scenarios in which measures by a foreign state authority have effects vis-à-vis residents in Germany and that such an obligation can also follow from the right to informational self-determination. In his view, Article 32.a of the Convention authorises the impairment of interests protected under that right without any restrictions. According to him, the right to informational self-determination is also violated because foreign states are being authorised to commit serious interferences with fundamental rights in violation of the principle of the sovereignty of people and without constitutional basis. In his view, Article 32.a of the Convention also violates the “right to democracy”; the legislature must ensure that the legal situation under the Convention is made compatible with the requirements under the Constitution.