Order of 24 June 2025

R e a s o n s :

A. 

1

The constitutional complaint concerns authorisations in Land police law to carry out telecommunications surveillance and source telecommunications surveillance.

I. 

2

With their constitutional complaint, the complainants challenge § 20c of the North Rhine-Westphalia Police Act (Polizeigesetz des Landes Nordrhein-Westfalen – PolG NRW; hereinafter: the Act) as amended by the Act to Adapt the North Rhine-Westphalia Police Act and the Act on the Organisation and Powers of the Public Security Authorities of 18 December 2018 (North Rhine-Westphalia Law and Ordinance Gazette, Gesetz- und Verordnungsblatt Nordrhein-Westfalen – GV NRW p. 741, corrected 2019 p. 23), which entered into force on 29 December 2018, as well as § 8(4) of the North Rhine-Westphalia Police Act as amended by the Act to Strengthen Security in North Rhine-Westphalia – Sixth Act Amending the North Rhine-Westphalia Police Act of 13 December 2018 (GV NRW p. 684, corrected 2019 p. 23), which entered into force on 20 December 2018. The provisions in the version challenged here read as follows:

§ 20c of the North Rhine-Westphalia Police Act – Data collection through surveillance of ongoing telecommunications

(1) ¹The police may, without the knowledge of the affected person, monitor and record ongoing telecommunications of a person

1. who is responsible pursuant to §§ 4 or 5, if this is required to avert a present danger to the existence or security of the Federation or a Land or to life or limb of a person,

2. whose individual conduct establishes a specific probability that they will commit a terrorist offence pursuant to § 8(4) in the foreseeable future and it is at least possible to determine how this offence will be committed,

3. for whom specific facts give rise to the assumption that they receive or forward messages intended for or originating from a person as referred to in number 1, or

4. for whom specific facts give rise to the assumption that a person as referred to in number 1 will use their telecommunications connection or user device

and if averting the danger or preventing the criminal offences in any other way is futile or considerably more difficult. ²The measure may be carried out even if this unavoidably results in third parties being affected.

(2) Telecommunications may be monitored and recorded without the knowledge of the person concerned by intrusion, through technical means, into information technology systems used by the person concerned if

1. technical measures ensure that only ongoing telecommunications are monitored and recorded, and

2. the intrusion into the information technology system is necessary to enable the monitoring and recording of telecommunications, in particular in unencrypted form.

(3) ¹With regard to measures under subsection (2), it must be ensured that

1. only such modifications to the information technology system are made as are indispensable for the collection of the data, and

2. the modifications are reversed by automated means upon termination of the measure, if technically possible.

²The means used must be protected against unauthorised use. ³Copied data must be protected against modification, unauthorised deletion and unauthorised inspection.

(4) ¹Measures pursuant to subsection (1) and (2) may only be ordered by the Local Court in whose district the police authority is headquartered upon application of the head of the police authority or their deputy. ²The provisions of the Act on Proceedings in Family Matters and in Matters of Non-Contentious Jurisdiction (Gesetz über das Verfahren in Familiensachen und in den Angelegenheiten der freiwilligen Gerichtsbarkeit – FamFG) shall apply accordingly to the procedure.

(5) The application shall state:

1. the person against whom the measure is directed, if possible, including their name and address,

2. the phone number or any other identification number of the subscriber line or user device to be monitored, unless specific facts show that it is assigned to other user devices at the same time,

3. the type, scope and duration of the measure,

4. additionally, in the case of subsection (2), a designation, as precise as possible, of the information technology system to be infiltrated with a view to data collection, and the designation of the manufacturer and the software version of the technical means to be used,

5. the facts of the case and

6. reasons for the measure.

(6) ¹The court shall issue the order in writing. ²It shall state:

1. an identification number of the subscriber line or the user device for which the data collection is carried out,

2. additionally, in the case of subsection (2), a designation, as precise as possible, of the information technology system to be infiltrated with a view to data collection.

³For the rest, § 18(2) third sentence shall apply accordingly, with the exception that the private home concerned need not be designated. ⁴The order shall be limited to a maximum duration of three months. ⁵The duration may be extended by no more than three months at a time if the conditions for the order continue to be met, taking into account the information obtained in the course of the measures taken. ⁶If the conditions on which the order was based are no longer met, the measures taken on the basis of the order must be terminated without delay. ⁷§ 18(2) fifth to ninth sentence shall apply accordingly.

(7) ¹Whoever provides, or is involved in, telecommunications services (service providers) shall, based on the order, enable the police to take the measures referred to in subsection (1) and provide the required information without delay. ²Whether and to what extent prior arrangements have to be made in this respect shall be governed by the Telecommunications Act (Telekommunikationsgesetz – TKG) and the Ordinance on the Technical and Organisational Implementation of Telecommunications Surveillance Measures (Telecommunications Surveillance Ordinance, Verordnung über die technische und organisatorische Umsetzung von Maßnahmen zur Überwachung der Telekommunikation – TKÜV). ³§ 23 of the Judicial Remuneration and Compensation Act (Justizvergütungs- und -entschädigungsgesetz – JVEG) shall apply accordingly to the compensation of service providers.

(8) ¹If factual indications give rise to the assumption that a measure pursuant to subsections (1) and (2) will only yield information from the core of private life, the measure is impermissible. ²If, in the context of measures referred to in subsections (1) and (2), data is directly inspected while being automatically recorded, the measure must be suspended immediately if facts revealed during the surveillance measure suggest that contents that can be attributed to the core of private life are recorded. ³Information from the core of private life which has been obtained by a measure pursuant to subsections (1) and (2) may not be used. ⁴Any recordings thereof must be deleted without delay. ⁵The fact that the data was collected and deleted must be documented. ⁶The documentation shall be used exclusively for data protection audits pursuant to § 33c. ⁷It shall be deleted six months after notification pursuant to § 33(2) first sentence has been given or six months after court approval pursuant to § 33(4) seventh sentence has been given. ⁸If data protection audits are still ongoing, the documentation shall be kept until their completion. ⁹For the rest, § 18(3) third sentence and § 18(4) second to seventh sentence shall apply accordingly.

(9) ¹When data is collected pursuant to subsections (1) and (2), the details set out in § 33b(1) and (2) shall be documented. ²In the case of subsection (2), the following details shall additionally be documented:

1. details identifying the information technology system and the modifications made to it that are not merely transitory,

2. details regarding the manufacturer of the means used for data collection and the software version used.

(10) (repealed)

(11) (repealed)

(12) ¹The Land Government shall review the effectiveness of the provision through 31 December 2022 and shall report the outcome of the evaluation to the Landtag. ² § 20c shall cease to have effect on 31 December 2023.

3

Art. 1 no. 6(b) of the Act Strengthening the Rights of Persons Held in Police Custody (Gesetz zur Stärkung der Rechte von im Polizeigewahrsam festgehaltenen Personen) of 19 December 2019 (GV NRW p. 995) designated subsection (12) of § 20c of the North Rhine-Westphalia Police Act as its subsection (10) with effect from 31 December 2019.

4

§ 8(4) of the Act, which is referred to in § 20c(1) first sentence no. 2 of the Act, reads as follows:

§ 8 of the North Rhine-Westphalia Police Act – General powers, definitions

(4) Criminal offences pursuant to

1. § 211, § 212, § 226, § 227, § 239a, § 239b, § 303b, § 305, § 305a, §§ 306 through 306c, § 307(1) through (3), § 308(1) through (4), § 309 (1) through (5), § 313, § 314, § 315 (1), (3) or (4), § 316b(1) or (3), § 316c(1) through (3), § 317(1), § 328(1) or (2), § 330(1) or (2), or § 330a(1) through (3) of the Criminal Code (Strafgesetzbuch – StGB),

2. §§ 6 through 12 of the Code of Crimes against International Law (Völkerstrafgesetzbuch – VStGB) of 26 June 2002 (Federal Law Gazette, Bundesgesetzblatt – BGBl I p. 2254), as amended by Article 1 of the Act of 22 December 2016 (BGBl I p. 3150),

3. § 19(1) through (3), § 20(1) or (2), § 20a(1) through (3), § 19(2) no. 2 or (3) no. 2, § 20(1) or (2) or § 20a (1) through (3), each also in conjunction with § 21, or § 22a (1) through (3) of the War Weapons Control Act (Kriegswaffenkontrollgesetz – KrWaffKontrG) in the version published on 22 November 1990 (BGBl I p. 2506), last amended by Article 6(2) of the Act of 13 April 2017 (BGBl I p. 872), and

4. § 51(1) through (3) of the Weapons Act (Waffengesetz – WaffG) of 11 October 2002 (BGBl I p. S. 3970, 4592; 2003 I p. 1957), last amended by Article 1 of the Act of 30 June 2017 (BGBl I p. 2133),

are terrorist offences within the meaning of this Act, if and insofar as they are intended to seriously intimidate the population, to unlawfully coerce an authority or an international organisation by force or threat of force or to destroy or significantly impair the fundamental political, constitutional, economic or social structures of a state or of an international organisation and which, given the nature or consequences of such offences, can seriously damage a state or an international organisation.

II.

5

1. The legislator in North Rhine-Westphalia newly introduced § 20c into the Act in 2018; for the first time, it set out police powers to carry out preventive telecommunications surveillance and source telecommunications surveillance in order to improve the effectiveness of public security measures protecting the population from dangers arising from (international) terrorism in particular. According to the explanatory memorandum to the draft act, the expansion of police powers was required because the abstract threat level remained high. The legislator argued that, in addition to terrorist threats, petty crime was becoming increasingly organised and that police powers therefore had to be expanded with regard to this category of crime in order to improve the security of the population. It stated that new and efficient ways needed to be found to investigate dangers before they arise, uncover connections in the preparatory stages of a crime and ultimately prevent serious criminal acts (cf. Landtag NRW document, Landtagsdrucksache NRW – LTDrucks NRW 17/2351, pp. 1, 27).

6

According to the explanatory memorandum, the covert surveillance of telecommunications is a key factor in this regard. Terrorists in particular rely on the use of mobile devices and of modern means of communication to prepare and carry out criminal acts. According to the legislator, it is only through access to these communications that the police can trace relevant connections, accurately investigate the target person and identify networks and relationships. The legislator argued that the power to carry out source telecommunications surveillance is indispensable as an addition to traditional telecommunications surveillance because it is the only way to ensure that encrypted contents can be accessed. As criminals make use of such encryption technologies in view of advancing digitalisation, the police must be able to respond (cf. LTDrucks NRW 17/2351, p. 36).

7

2. § 20c(1) of the Act provides for the power to carry out traditional telecommunications surveillance; § 20c(2) of the Act expands this power to include source telecommunications surveillance. Pursuant to § 20c(12) second sentence of the Act in the challenged version, the provisions initially applied until 31 December 2023. Following their evaluation ([…]), they were extended until 31 December 2028 by Art. 1 no. 2 of the Seventh Act Amending the North Rhine-Westphalia Police Act of 19 December 2023 (GV NRW p. 1394).

8

a) § 20c(1) of the Act permits the monitoring and recording of ongoing telecommunications without the knowledge of the individual targeted by the measure. Police authorities are therefore authorised to read and listen in on (monitor) and store (record) telecommunications that take place at the time of surveillance, usually with the cooperation of service providers (cf. § 20c(7) of the Act). The provision does not contain any restrictions on the type of ongoing telecommunications to be put under surveillance. In practice, service providers divert the entire raw data stream ([…]). This not only includes the contents and meta data of telecommunications between persons, but all data transmitted via the Internet ([…]; regarding the surveillance of telecommunications by the Federal Intelligence Service, see Decisions of the Federal Constitutional Court, Entscheidungen des Bundesverfassungsgerichts – BVerfGE 154, 152 <181 para. 10> – Federal Intelligence Service – Foreign surveillance), with a large part of the raw data being practically unreadable due to encryption.

9

The prerequisites for telecommunications surveillance depend on which preventive purpose such surveillance serves and what persons it targets. § 20c(1) first sentence no. 1 of the Act permits surveillance of the person responsible pursuant to §§ 4 or 5 of the Act if this is required to avert a present danger (gegenwärtige Gefahr) to the existence or security of the Federation or a Land or to life or limb of a person. Yet pursuant to § 20c(1) first sentence no. 2 of the Act, surveillance may also be directed against persons whose individual conduct establishes a specific probability that they will commit a terrorist offence pursuant to § 8(4) of the Act in the foreseeable future and it is at least possible to determine how this offence will be committed (so-called persons posing a terrorist threat, Gefährder). The provision thus permits surveillance with the aim of preventing criminal acts as a precautionary measure even before a specific danger (konkrete Gefahr) arises. § 20c(1) first sentence nos. 3 and 4 of the Act extend potential addressees of the provision to include persons in respect of whom it can be assumed that they receive or transmit messages for or from persons referred to in § 20c(1) first sentence no. 1 of the Act (so-called intermediaries), and persons in respect of whom it can be assumed that a person referred to in § 20c(1) first sentence no. 1 of the Act will use their subscriber line or user device (so-called device or subscriber line providers). All applications of the provision require that averting the danger or preventing the criminal act in any other way is futile or considerably more difficult.

10

b) Under § 20c(2) of the Act, telecommunications may also be monitored and recorded by means of technical infiltration of information technology systems (IT systems) used by the targeted individual (source telecommunications surveillance). Surveillance through the accessing of an IT system aims to also capture such communication contents which, due to their encryption, could not be analysed, or could only be analysed with unreasonable effort, when employing traditional telecommunications surveillance (as is the case for communication through instant messenger applications like WhatsApp or Signal, cf. also LTDrucks NRW 17/2351, p. 37). In these instances, the communication may be accessed at the ‘source’, i.e., where the communication contents have not yet been encrypted or have been decrypted again – which means before encryption on the transmission device or after decryption on the receiving device. To this end, the police may use technical means to access the IT system used by the affected person; the legislator assumes that this is done through the use of surveillance software (so-called trojans) (cf. § 20c(5) no. 4, § 20(9) second sentence no. 2 of the Act). A system may only be infiltrated if technical measures ensure that only ongoing telecommunications are monitored and recorded (cf. § 20c(2) no. 1 of the Act). Infiltrating the system must also be necessary for monitoring and recording telecommunications, in particular in unencrypted form (cf. § 20c(2) no. 2 of the Act).

11

c) A surveillance measure pursuant to § 20c of the Act may only be ordered by the Local Court upon application (cf. § 20c(4) first sentence of the Act). The order must be limited to a maximum duration of three months, but may be extended (cf. § 20c(5) and (6) of the Act).

III. 

12

The complainants challenge the powers to carry out telecommunications surveillance (§ 20c(1) of the Act) and source telecommunications surveillance (§ 20c(1) in conjunction with § 20c(2) of the Act) and, in particular, § 20c(1) first sentence no. 2 in conjunction with § 8(4) of the Act. They claim that the challenged provisions violate their fundamental rights under Art. 1(1), Art. 2(1) in conjunction with Art. 1(1) (confidentiality and integrity of IT systems), and Art. 10(1) of the Basic Law (Grundgesetz – GG).

13-37

[…]

IV. 

38

Statements on the constitutional complaint were submitted by the Land Government of North Rhine-Westphalia, the (then) Federal Commissioner for Data Protection and Freedom of Information, the Land Commissioner for Data Protection and Freedom of Information for North Rhine-Westphalia and the Bavarian Land Commissioner for Data Protection.

39-46

[…]

B. 

47

The constitutional complaint is only admissible in part. Complainant no. 4) failed to submit his constitutional complaint in due form ([…]). Moreover, the complainants failed to effectively demonstrate their standing and, in particular, did not in all respects demonstrate the possibility of a fundamental rights violation (see II. below). For the rest, the constitutional complaint satisfies the subsidiarity requirements (see III. below). The Federal Constitutional Court has jurisdiction for deciding the constitutional complaint (see IV. below).

I. 

48

[…]

II. 

49

The other complainants only have standing in part.

50

Pursuant to Art. 94(1) no. 4a of the Basic Law and § 90(1) of the Federal Constitutional Court Act (Bundesverfassungsgerichtsgesetz – BVerfGG), a constitutional complaint can only be admissible if complainants assert that their fundamental rights – or rights equivalent to fundamental rights – have been violated by an act of public authority (cf. BVerfGE 140, 42 <54 para. 47>). They must demonstrate, in accordance with the substantiation requirements under § 23(1) second sentence and § 92 of the Federal Constitutional Court Act, that a violation of fundamental rights appears possible and that they are individually, directly and presently affected. If a constitutional complaint is directed against legislation that authorises security authorities to carry out covert surveillance measures, special admissibility prerequisites apply in this regard (for more details BVerfGE 165, 1 <30 ff. para. 39 ff.> – Police powers under the Security and Public Order Act for Mecklenburg-Western Pomerania; established case-law).

51

1. Based on these standards, the complainants did not sufficiently demonstrate that a duty of protection arising from fundamental rights, in particular from the fundamental right protecting IT systems (Art. 2(1) in conjunction with Art. 1(1) of the Basic Law), may have been violated.

52

A constitutional complaint asserting that the legislator would have had to restrict the technical possibilities for infiltrating an IT system to protect the IT security of the general public is subject to special constitutional substantiation requirements. Complainants must address the entire legislative context, which requires at a minimum that the relevant provisions of the legislative framework challenged as inadequate by the complainants are outlined and that reasons are given as to why the legislative design is considered to fall short (cf. BVerfGE 158, 170 <191 f. para. 51> – IT security vulnerabilities; 162, 1 <58 para. 111> – Bavarian Protection of the Constitution Act).

53

The present constitutional complaint does not satisfy these substantiation requirements. […]

54

2. The complainants have demonstrated only in part that the powers set out in § 20c of the Act may have violated both the fundamental right protecting IT systems in its dimension as a defensive right against state interference and Art. 10(1) of the Basic Law.

55

a) Insofar as the complainants challenge the constitutionality of the power to carry out source telecommunications surveillance, they have demonstrated a possible interference with both the fundamental right protecting IT systems (Art. 2(1) in conjunction with Art. 1(1) of the Basic Law) and the privacy of telecommunications (Art. 10(1) of the Basic Law), the assessment as to which right takes precedence notwithstanding (see para. 105 below).

56

By contrast, with regard to the challenged power to carry out [traditional] telecommunications surveillance, only an interference with the privacy of telecommunications can be at issue. […]

57

b) The complainants have demonstrated a possible violation of fundamental rights insofar as they have challenged the fact that the weight of the legal interests to be protected by § 20c(1) first sentence no. 2 of the Act is insufficient for justifying telecommunications surveillance or source telecommunications surveillance. The remainder of the complainants’ submissions does not meet the substantiation requirements.

58

aa) Insofar as the complainants assert that the challenged provisions do not satisfy the constitutional requirements arising from the principle of specificity and legal clarity and from the essential matters doctrine – this concerns § 20c(1) first sentence, first half-sentence of the Act due to the vague wording of the legal consequences it prescribes, § 20c(1) first sentence no. 2 of the Act due to the mere adoption of phrases from decisions of the Federal Constitutional Court into the legal text and § 8(4) second half-sentence of the Act [due to the way in which it defines terrorism, see para. 143 below] –, their submissions do not meet the substantiation requirements. […]

59

bb) The complainants have also failed to substantiate that the power to carry out source telecommunications surveillance is inherently contradictory and could be unconstitutional for this reason alone. It is true that, in light of the rule of law, a provision may not be inherently contradictory and thus create incentives for an application that is not covered by its constituent elements. However, the complainants have not shown that the provisions may be inherently contradictory with regard to the surveillance of ongoing telecommunications permitted by § 20c(1) in conjunction with § 20c(2) of the Act because the requirement that the restriction to ongoing telecommunications must be ensured by technical means (§ 20c(2) no. 1 of the Act) cannot be met as such technical restriction is not possible (cf. in this regard BVerfGE 141, 220 <311 para. 234>).

60

They have not clearly differentiated to what extent restrictions of possible data access require that the scope of data access provided by the surveillance software used can itself be restricted or whether it would suffice to limit the visibility of the data for the persons carrying out the surveillance. Yet such differentiation would have been necessary. According to the Federal Constitutional Court’s established case-law, it is decisive whether the surveillance software has been designed in such a way that the staff members responsible for the surveillance can only inspect ongoing communication contents (cf. in this regard BVerfGE 141, 220 <311 f. para. 234>; […]). […]

61

[…]

62

cc) The complainants have sufficiently demonstrated the possibility of a violation of fundamental rights insofar as they argue that some of the terrorist offences referenced in § 20c(1) first sentence no. 2 and § 20c(2) of the Act through the referral to § 8(4) of the Act do not protect sufficiently weighty legal interests.

63

dd) With regard to the challenge that the powers at issue are disproportionate on the grounds that the surveillance of third parties under § 20c(1) first sentence nos. 3 and 4 of the Act does not require greater prospects of success and is not subsidiary to other measures, the complainants have failed to discuss the possibility of interpreting the provision in conformity with the Constitution. […]

64

Finally, the complainants have not given sufficient reasons insofar as they claim that § 20c(2) of the Act lacks a differentiation as to whether the infiltrated IT system is the target person’s own system or a system which the target person shares with a third party. The complainants have failed to even address the ordinary law in this respect. […]

65

ee) The complainants also have not demonstrated that the challenged powers may interfere with the core of private life, which enjoys absolute protection. They have failed to demonstrate that § 20c(1) and (2) of the Act may not satisfy the special requirements for the protection of the core of private life arising from the relevant fundamental rights in conjunction with Art. 1(1) of the Basic Law in the case of particularly intrusive surveillance measures (cf. in this regard BVerfGE 141, 220 <276 para. 119>). This applies accordingly insofar as the complainants separately assert a violation of Art. 1(1) of the Basic Law.

66-68

[…]

69

ff) Insofar as the complainants argue that source telecommunications surveillance requires, in addition to the requirement of prior judicial authorisation set out in § 20c(4) first sentence of the Act, the ‘determination of an independent body’ to thoroughly review technical requirements and, in particular, ascertain that the surveillance can be restricted to ongoing communications as required by § 20c(2) no. 1 of the Act, they have not shown a violation of fundamental rights.

70

[…]

71

3. Complainants nos. 1), 2), 5) and 6) have demonstrated to differing degrees that they are affected. By contrast, the submissions of complainant no. 3) are insufficient in this regard.

72

a) All complainants are directly affected, within the meaning of constitutional procedural law, by measures pursuant to § 20c of the Act. The provisions give rise to covert surveillance measures. The notification requirements provided for in § 33(1) no. 7 of the Act only counter their covert nature in part, because § 33(2) and (3) of the Act restrict or completely dispense with them. Even the assertion of a possible right to information under § 35(1) no. 1 and § 49 of the North Rhine-Westphalia Data Protection Act (Datenschutzgesetz Nordrhein-Westfalen – DSG NRW) is subject to far-reaching restrictions (cf. § 49(4), § 48(2) North Rhine-Westphalia Data Protection Act).

73

b) Complainant no. 3) has not demonstrated that he is individually and presently affected, while the other complainants have only demonstrated this in part.

74

aa) Detailed reasons must be given to establish that complainants may be individually and presently affected. Insofar as the complainants assert that they may be affected as target persons, further submissions are required as to why there is a sufficient probability that they may, due to personal circumstances, be subject to surveillance measures targeted specifically at them. In this respect, the challenged surveillance powers only have limited indiscriminate effects, because the restriction to specific thresholds for interference and to protected legal interests means that a clear connection to the individual case is required and because a requirement of prior judicial authorisation is also in place. By contrast, the assertion that the complainants are affected as third parties may be subject to lower burdens of substantiation. With regard to third parties, the indiscriminate effects of the challenged powers are not equally limited, given that persons can be included in telecommunications surveillance who merely maintain electronic communications with potential target persons without being themselves directly linked to a potential danger to be averted or a criminal act to be prevented (cf. BVerfGE 113, 348 <383>; 141, 220 <262 para. 84>; cf. also BVerfGE 165, 1 <32 para. 44, 39 f. para. 63>; 169, 332 <360 para. 66>).

75-76

bb) […]

III. 

77

Insofar as the complainants have standing, they satisfy the requirements regarding the subsidiarity of the constitutional complaint.

78

1. In order to ensure the subsidiarity of the constitutional complaint, the complainants must, in addition to exhausting all legal remedies in the strict sense, use any means at their disposal that might remedy the asserted violation of fundamental rights. This also serves the purpose of ensuring that the Federal Constitutional Court does not have to take far-reaching decisions on an uncertain factual and legal basis. It is the ordinary courts – which are primarily responsible for the interpretation and application of ordinary law – that must first address the points of fact and law at issue. The principle of subsidiarity therefore generally requires that, before lodging a constitutional complaint, the complainants first pursue all available procedural options that might remedy the alleged violation of the Constitution or prevent a fundamental rights violation. This also applies if it is unclear whether the type of remedy sought is in principle admissible and can be admissibly lodged in the specific case (cf. BVerfGE 150, 309 <326 para. 43>; 165, 1 <32 f. para. 45>; 169, 130 <155 f. para. 40> – Hessian Protection of the Constitution Act; established case-law).

79

If complainants directly challenge legislation, the legal remedies that need to have been sought beforehand may include the filing of a declaratory action or an action for an injunction with the ordinary courts. This applies even if the provisions at issue are exhaustive and the best possible outcome of a review by the ordinary courts is that the challenged law is referred to the Federal Constitutional Court pursuant to Art. 100(1) of the Basic Law. In this respect, too, it is decisive whether prior review by the ordinary courts is necessary to avoid a situation in which the Federal Constitutional Court would have to decide on an uncertain factual and legal basis. This will typically be the case if the challenged provisions contain legal terms that are subject to interpretation, and the interpretation and application of these terms significantly influence the extent to which complainants are adversely affected, both with regard to the facts and the law (cf. BVerfGE 169, 130 <156 para. 41>). Where the assessment of a provision raises question that specifically concern only constitutional law, which are for the Federal Constitutional Court to answer, without any improved basis for decision-making to be expected from a prior examination by the ordinary courts, there is no need for such prior decision (cf. BVerfGE 165, 1 <33 para. 47.>; established case-law).

80

2. Based on these standards, the complainants cannot be expected to first seek legal protection in the ordinary courts.

81

It cannot be ascertained that the complainants could meet (cf. also BVerfGE 170, 79 <125 para. 128> – Federal Intelligence Service – Cyberthreats) the admissibility prerequisites of the ordinary courts for preventive legal protection against covert surveillance measures (cf. Decisions of the Federal Administrative Court, Entscheidungen des Bundesverwaltungsgerichts – BVerwGE 149, 359 <364 para. 19 ff.>; 157, 8 <9 ff. para. 11 ff.>; 161, 76 <77 f. para. 12 ff.>; 177, 327 <335 ff. para. 21 ff.>; Federal Administrative Court, Judgment of 9 November 2023 - 10 A 3.23 -, para. 13 with further references).

82

The questions raised here are questions that specifically concern constitutional law. The delineation of the scope of protection of different fundamental rights guarantees, on the basis of which the constitutional review could be conducted, and the proportionality assessment required in light of previous case-law of the Federal Constitutional Court concern specifically constitutional questions. No improved basis for answering these questions can be expected from prior review by the ordinary courts.

IV. 

83

The Federal Constitutional Court has jurisdiction to review the compatibility of the challenged provisions with the fundamental rights of the Basic Law, even though these provisions are related to data protection provisions in legal acts of the European Union, such as the Law Enforcement Directive 2016/680/EU. The provisions do not implement binding EU law, given that legal acts of the European Union do not contain any provisions that require the challenged police powers, let alone provide an exhaustive legal framework; the challenged powers are not fully determined by EU law (cf. also BVerfGE 155, 119 <162 ff. para. 83 ff.> – Subscriber data II; 165, 1 <29 para. 35>; 170, 247 <268 f. para. 57 f.> – North Rhine-Westphalia Police Act – Observations). This does not affect the question of whether additional legal requirements arise directly from secondary EU law and whether the challenged provisions are compatible with those legal requirements (cf. BVerfGE 155, 119 <165 para. 88> with further references).

C.

84

To the extent that it is admissible, the constitutional complaint is unfounded. While the challenged surveillance powers in § 20c(1) first sentence no. 2 and § 20c(1) first sentence no. 2 in conjunction with § 20c(2) of the Act interfere with the complainants’ fundamental rights (see I. below), the interferences are justified under constitutional law; in particular, they satisfy the proportionality requirements (see II. below).

I.

85

§ 20c of the Act gives rise to interferences with the privacy of telecommunications under Art. 10(1) of the Basic Law and – with regard to source telecommunications surveillance – with the fundamental right protecting IT systems under Art. 2(1) in conjunction with Art. 1(1) of the Basic Law.

86

1. The power to carry out [traditional] telecommunications surveillance under § 20c(1) no. 2 of the Act interferes with Art. 10(1) of the Basic Law (privacy of telecommunications).

87

a) The fundamental right to the privacy of telecommunications protects the intangible transmission of information by way of telecommunications (cf. BVerfGE 67, 157 <172>; 106, 28 <35 f.>). In principle, state authorities are not allowed to obtain knowledge of the contents and meta data of communications made via telecommunications systems (cf. BVerfGE 113, 348 <364>; 170, 79 <127 para. 135>). Since communicating at a distance requires a technical transmission process which is not controlled by those affected alone, such communication is particularly vulnerable to the risk of third parties obtaining knowledge thereof. Art. 10(1) of the Basic Law protects against the specific risks associated with remote communication and in this way safeguards privacy at a distance (cf. BVerfGE 106, 28 <36>; 115, 166 <182>); this also includes access to a user device in order to obtain communication-related data (cf. BVerfGE 106, 28 <37 f.>; 115, 166 <186 f.>). At the same time, the fundamental right means to preserve the conditions that are necessary to ensure free telecommunications in general (cf. BVerfGE 100, 313 <358 f.>; 107, 299 <313>; 129, 208 <241>).

88

aa) The privacy of telecommunications under Art. 10(1) of the Basic Law first and foremost protects the content of communications. Art. 10 of the Basic Law does not distinguish between communication of a private nature and other communication, such as business or political communication. Rather, the fundamental rights protection extends to all communication taking place by means of telecommunications technology (cf. BVerfGE 100, 313 <358>; 113, 348 <364>; 124, 43 <54>; BVerfGE 170, 79 <127 para. 136>). It also protects the communication-related meta data. In particular, this includes whether, when, and how often telecommunications occurred or were attempted, between whom and between which devices (cf. BVerfGE 67, 157 <172>; 120, 274 <307>; 129, 208 <240 f.>; 155, 119 <168 para. 98>; established case-law). Finally, the protection afforded by Art. 10(1) of the Basic Law is independent of the type of transmission and form of expression used (cf. BVerfGE 115, 166 <182 f.>; 120, 274 <307>). By contrast, the content and meta data of communication stored within the domain controlled by affected persons – after the transmission has been completed – are not protected by the fundamental right, because such data is no longer subject to the specific risks of remote communication, which the privacy of telecommunications aims to avert (cf. BVerfGE 115, 166 <183 f.>; 120, 274 <307 f.>; 124, 43 <54>).

89

bb) The fundamental right under Art. 10(1) of the Basic Law is open to adaptation to new developments. It covers the modes of transmission that were known when the Basic Law was created as well as novel transmission technologies (cf. BVerfGE 115, 166 <182>; cf. also BVerfGE 46, 120 <143 f.>). Likewise, it counters both old and new risks to one’s personality arising from the increased significance of information technology for the development of individual personality (cf. BVerfGE 120, 274 <307>; 170, 79 <127 para. 135>). The protection afforded by the fundamental right therefore also extends to Internet communication services (cf. BVerfGE 120, 274 <307>; 124, 43 <54>).

90

Whether and to what extent Art. 10(1) of the Basic Law provides protection to individual holders of the fundamental right against new risks must be determined in consideration of the purpose of the fundamental rights guarantee and the underlying specific risks (cf. also BVerfGE 106, 28 <38>; 115, 166 <186 f.>; 124, 43 <56>). It is decisive in this respect that the privacy of telecommunications serves to compensate for the loss of control of one’s private sphere that results from the use of technology as an inevitable consequence of relying on communication channels operated by third parties for the transmission of data across distances (cf. BVerfGE 115, 166 <186>). The privacy of telecommunications is therefore tied to the use of communication channels and the specific risks this entails (cf. also BVerfGE 106, 28 <43>; 124, 43 <54 f.>); the confidential use of communication media is to be ensured in all respects (cf. BVerfGE 100, 313 <358>; 129, 208 <241>).

91

The privacy of telecommunications has thus always protected individual remote communication by means of telecommunication devices, i.e. the transmission of information to individual recipients (cf. BVerfGE 115, 166 <182>; 120, 274 <306 f.>; 124, 43 <54>; 125, 260 <309>; 130, 151 <179>; 155, 119 <168 para. 98>). Yet the specific risks against which Art. 10(1) of the Basic Law provides protection (cf. BVerfGE 106, 28 <43>) do not just arise when two or more people engage in remote communication. Due to its openness to adaptation to new developments (cf. BVerfGE 115, 166 <182>), the fundamental right also protects against new risks arising from the increased importance of information technology for the development and exercise of individual personality, and thus generally also protects other data transmitted across distances by means of telecommunications technology (cf. BVerfGE 154, 152 <181 para. 10, 227 f. para. 111, 229 para. 114>; […]). The risks against which the fundamental right provides protection can also arise, for example, from surfing the Internet (cf. regarding the accessing of a website BVerfGE 120, 274 <340>; cf. also BVerfGE 125, 260 <311>; Federal Constitutional Court, Order of the Third Chamber of the Second Senate of 6 July 2016 - 2 BvR 1454/13 -, paras. 30, 37) or from accessing emails (cf. BVerfGE 124, 43 <54 ff.>; cf. regarding Art. 8 of the European Convention on Human Rights and Fundamental Freedoms: European Court of Human Rights, Copland v. the United Kingdom, Judgment of 3 April 2007, no. 62617/00, § 41 f.); they can also arise from uploading and downloading data via the Internet and in particular from data sharing through services provided online (so-called cloud services, including software as a service models; […]). Holders of the fundamental right need protection in this respect, too, as the remote transmission of data that may potentially affect their personality is a process they depend on but cannot control and which may be accessible to third parties. At the same time, they have a legitimate expectation of confidentiality regarding the contents of the communication and the meta data ([…]). Therefore, the interception of raw data stemming from telecommunications falls within the scope of protection of Art. 10(1) of the Basic Law (cf. BVerfGE 170, 79 <128 f. para. 141 f.); this also applies to automatically transmitted location data of mobile phones (cf. BVerfGE 113, 348 <382 f.>; 154, 152 <180 f. para. 10, 227 ff. para. 111 ff., 252 para. 172>) or data transmitted during automated data synchronisation or backups.

92

b) The power in § 20c(1) first sentence no. 2 of the Act authorises the collection of personal data through the covert surveillance of telecommunications, and thus gives rise to interferences with the privacy of telecommunications under Art. 10(1) of the Basic Law (cf. also BVerfGE 165, 1 <85 para. 160>). Not only does it permit the covert monitoring and recording of traditional phone calls between landlines or mobile phones, it also covers the entire raw data transmitted via the Internet (cf. also para. 8). The decisive factor here are the possibilities of use that the challenged surveillance power opens up in both legal and practical terms (cf. also BVerfGE 162, 1 <144 para. 320, 147 para. 326>; 165, 363 <429 para. 149> – Automated data analysis).

93

2. The power to carry out source telecommunications surveillance under § 20c(1) first sentence no. 2 in conjunction with § 20c(2) of the Act curtails the guarantees of both Art. 10(1) of the Basic Law (see a) below) and the fundamental right protecting IT systems (see b) below). It must therefore be reviewed on the basis of both guarantees (see c) below).

94

a) The power under § 20c(1) in conjunction with § 20c(2) of the Act, which authorises the monitoring and recording of ongoing telecommunications (cf. para. 92), gives rise to interference with the privacy of telecommunications protected by Art. 10(1) of the Basic Law (cf. BVerfGE 141, 220 <309 para. 228>; 158, 170 <184 para. 28>; 165, 1 <85 para. 160>; established case-law).

95

b) The surveillance power also curtails the general right of personality (Art. 2(1) in conjunction with Art. 1(1) of the Basic Law) in its manifestation as the fundamental right protecting the confidentiality and integrity of information technology systems (fundamental right protecting IT systems), because it authorises the monitoring and recording of ongoing communications by accessing the IT system used by affected persons (cf. in this regard BVerfGE 120, 274 <308>).

96

aa) The fundamental right protecting IT systems particularly protects against, but is not limited to, covert access via remote searches.

97

(1) It protects IT systems which may contain, by themselves or due to network connections, personal data of users in such volume and variety that access to the system grants insights into essential aspects of their personal life or even allows for the creation of a comprehensive personality profile (cf. BVerfGE 120, 274 <313 f.>). In addition to the volume and variety of the data concerned, the quality of the data is important. Even a relatively small amount of data on a modern IT system can provide profound insights into a person’s private life or personality. In this regard, data quality and data quantity are interrelated: high-quality – and thus meaningful – data can provide comprehensive insights into someone’s private life or personality, even when the amount of data available is small (cf. also BVerfGE 165, 363 <401 para. 78>; 170, 247 <281 f. para. 93 f.>).

98

(2) The fundamental right safeguards the confidentiality and integrity of the IT systems within its scope of protection. The quantity and quality of data that can potentially be intercepted from an IT system based on its technical design result in particular risks to the right of personality in case of infiltration. In this respect, it is the IT system itself that is protected. If affected persons use an IT system as their own, they have an expectation of confidentiality and integrity that must be recognised from a fundamental rights perspective (in more detail BVerfGE 120, 274 <315>).

99

Firstly, the protection extends to the user’s interest in the confidentiality (cf. BVerfGE 120, 274 <314>) of the data created, processed and stored within or accessible through an IT system protected by the fundamental right (cf. in this respect BVerfGE 141, 220 <303 f. para. 209 f.>). In addition, the fundamental right protects the integrity of the IT system, which is affected if the system is accessed in a manner that allows third parties to use its capacities, functions and stored contents; such access is the critical technical step that enables spying, monitoring or manipulation in relation to this system (cf. BVerfGE 120, 274 <314>).

100

The fundamental right protecting IT systems not only protects the confidentiality of data which is breached during data collection processes, but shifts this protection to an earlier stage, protecting even the abstract expectation of confidentiality of an IT system before specific data collection processes occur. Regardless of how much or little effort is needed to access an IT system (cf. BVerfGE 120, 274 <315>), the process of accessing the system in itself gives rise to specific risks for the data created, processed and stored within or accessible through the system (cf. also BVerfGE 120, 274 <308, 314>). The specific guarantees of the fundamental right protecting IT systems thus extend beyond the protection of personal data and provide anticipatory protection of one’s personality. Consequently, its scope of protection may vary depending on the IT system in question. It extends across all risks associated with that system as a whole (cf. BVerfGE 120, 274 <308 f., 313 ff.>; […]). The protection of the system is thus affected as soon as unauthorised parties gain access to the IT system and can thereby potentially intercept data – without actual interception being required ([…]).

101

As a consistent reflection of its protection afforded to the system, the fundamental right protects IT systems as virtual spaces for the preservation and development of one’s own personality in its entirety (cf. also BVerfGE 158, 170 <184 para. 29>; 162, 1 <139 f. para. 308>).

102

bb) Based on these guarantees of the fundamental right protecting IT systems, the power to carry out source telecommunications surveillance, despite being restricted to ongoing telecommunications, also gives rise to interference with this fundamental right ([…]).

103

The power to carry out source telecommunications surveillance under § 20c(1) first sentence no. 2 in conjunction with § 20c(2) of the Act permits access to the IT systems used by those affected in their entirety. Police authorities may use technical means to access IT systems in order to potentially make use of their capacities, functions and stored contents. It is irrelevant that the monitoring and recording pursuant to § 20c(1) first sentence and § 20(2) no. 1 of the Act are restricted to ongoing telecommunications. This restriction does not alter the fact that the potential risks directly arising from the use of technical means concern the expectation of confidentiality of the IT system as a whole. Once an intrusion into the system has occurred, the confidentiality of all data created, processed and stored within or accessible through the system is at considerable risk.

104

By contrast, no interference with the fundamental right protecting IT systems can be found when the IT system is not used as the user’s own system (cf. in this regard BVerfGE 120, 274 <315>), such as when surveillance results in another person (cf. § 20c(1) second sentence of the Act) being unavoidably affected as a third party.

105

c) To the extent that a measure affects both the fundamental right protecting IT systems as a manifestation of the general right of personality (Art. 2(1) in conjunction with Art. 1(1) of the Basic Law) and Art. 10(1) of the Basic Law, the fundamental right protecting IT systems does not automatically yield to the freedom guaranteed by Art. 10(1) of the Basic Law, which is, in principle, more specific than the general right of personality. Source telecommunications surveillance restricted to ongoing telecommunications must therefore be reviewed on the basis of both fundamental rights.

106

aa) The general right of personality (Art. 2(1) in conjunction with Art. 1(1) of the Basic Law) protects aspects of one’s personality that are not covered by the specific freedoms of the Basic Law, but are equal to these freedoms in terms of their foundational importance for one’s personality (cf. BVerfGE 120, 274 <303>). The specific freedoms therefore typically take precedence over the general right of personality (cf. BVerfGE 51, 97 <105>; 54, 148 <153>; 115, 166, <187>). Consequently, the right to informational self-determination, which is recognised as a manifestation of the general right of personality, is not applicable in addition to Art. 10(1) of the Basic Law, since the latter freedom contains a specific guarantee for telecommunications that supersedes the right to informational self-determination insofar as the protections afforded by the two rights overlap (cf. BVerfGE 113, 348 <364>; 125, 260 <310>; 155, 119 <169 f. para. 100>; Federal Constitutional Court, Order of the Third Chamber of the Second Senate of 6 July 2016 - 2 BvR 1454/13 -, para. 40).

107

That said, the overlapping protections mean that standards following from the right to informational self-determination are transferrable to the specific freedom enshrined in Art. 10(1) of the Basic Law (cf. BVerfGE 124, 43 <56>; 162, 1 <143 f. para. 319>; 169, 130 <172 para. 86>; cf. also Federal Constitutional Court, Order of the Third Chamber of the Second Senate of 6 July 2016 - 2 BvR 1454/13 -, para. 42) or that a review as to whether surveillance measures ‘in any case’ interfere with the right to informational self-determination may be sufficient (cf., e.g., BVerfGE 162, 1 <143 f. para. 319>; 165, 1 <48 para. 88>). Nor is the general right of personality subject to unlimited subsidiarity in all of its manifestations. Rather, specific freedoms and manifestations of the general right of personality can apply simultaneously (cf. BVerfGE 115, 166 <187 f.>). For instance, the general right of personality is not superseded in cases where its scope of protection and the scope of protection of a specific freedom only partially overlap, nor in cases that touch on a separate domain of freedom that has evolved independently and with clearly defined characteristics (cf. BVerfGE 115, 166 <187>). Insofar as different legal interests that are protected separately are affected in such cases, different fundamental rights or manifestations of a fundamental right apply simultaneously.

108

bb) With regard to the fundamental right protecting IT systems as a manifestation of the general right of personality, such a separate domain of freedom has evolved independently and with clearly defined characteristics (see para. 111). Thus, it is not superseded by the privacy of telecommunications under Art. 10(1) of the Basic Law. If powers authorise measures that curtail the protection afforded by both the fundamental right protecting IT systems and by Art. 10(1) of the Basic Law, these powers must stand up to review on the basis of both guarantees ([…]).

109

(1) In its Remote searches judgment from 2008 – the foundational decision for the fundamental right protecting IT systems – the Federal Constitutional Court ultimately did not clearly answer the question of the relationship between the fundamental right protecting IT systems and Art. 10(1) of the Basic Law. According to that judgment, the fundamental right protecting IT systems is applicable insofar as protection is not guaranteed by other fundamental rights such as Art. 10 of the Basic Law (cf. BVerfGE 120, 274 <302>, cf. also BVerfGE 124, 43 <57>); this initially only means that the fundamental right protecting IT systems is necessary as a further manifestation of the general right of personality in light of new risks to the free development and exercise of one’s personality, because the previously recognised fundamental freedoms did not give sufficient effect to the need for protection that had arisen in this regard (cf. BVerfGE 120, 274 <303 ff., 306>; cf. also BVerfGE 141, 220 <303 f. para. 209 f.>).

110

However, this does not automatically mean that the fundamental right protecting IT systems is subsidiary to other fundamental rights specifically laid down in the Basic Law. Firstly, the judgment expressly refrains from making a decision on whether other fundamental rights could have been violated in addition to the fundamental right protecting IT systems, in respect of which a violation was found (cf. BVerfGE 120, 274 <340>); this argues against any requirement that the fundamental right protecting IT systems must, by design, yield [to other fundamental rights] (cf. in this regard BVerfGE 54, 148 <153>). Secondly, the presumption of a precedence of Art. 10(1) of the Basic Law for powers to carry out source telecommunications surveillance restricted to ongoing communications only – which was not decisive in that case – conflicts with previous considerations according to which the technical infiltration of an IT system always carries the risk of personality-related information that goes beyond the contents and meta data of telecommunications being collected, as Art. 10(1) of the Basic Law does not sufficiently counter this risk (cf. BVerfGE 120, 274 <309>). In subsequent decisions, the question of the relationship between the fundamental right protecting IT systems and Art. 10(1) of the Basic Law was also not answered, given that the underlying facts of the cases concerned were covered in their entirety by one of the two fundamental rights (cf. BVerfGE 124, 43 <57>; 162, 1 <139 f. para. 307 f.>; 165, 1 <69 f. para. 128>). Should the Senate nevertheless have presumed that the fundamental right protecting IT systems was subsidiary [to other fundamental rights] in its [Remote searches] judgment of 27 February 2008 (BVerfGE 120, 274 <340>), it now departs from its previous case-law.

111

(2) As a manifestation of the general right of personality, the fundamental right protecting IT systems guarantees a separate domain of freedom with clearly defined characteristics; therefore, it is not superseded by Art. 10(1) of the Basic Law as the more specific guarantee even if both fundamental rights are affected (cf. regarding the dimension as a right giving rise to duties of protection BVerfGE 158, 170 <184 para. 27 ff.>).

112

It is true that the privacy of telecommunications may, in principle, be more specific than the general right of personality and – as the manifestation of the latter – the right to informational self-determination. If, however, this led to the right protecting IT systems also being superseded, this might mean that no comprehensive fundamental rights protection could be guaranteed, given the advances in information technology and the resulting ever increasing importance of IT systems for the personal life of individuals. This is because the fundamental right protecting IT systems and Art. 10(1) of the Basic Law address risks that, while overlapping, differ. While the fundamental right protecting IT systems guarantees protection of a virtual space for the preservation and development of one’s personality, the privacy of telecommunications protects the confidentiality of remote communication processes.

113

(a) IT systems are of great importance for the personal life of individuals today. This is mainly due to the ubiquity of the Internet in society and the many uses offered by modern digital devices, especially with regard to applications involving cloud computing or the Internet of things. In addition to traditional phone and email communication, this concerns, for example, the use of messenger services and social media and the use of IT devices as cameras, data processing programmes, ‘wallets’ for contactless payments, navigation systems, control units for household appliances or digital (voice) assistants, music players, diaries, reminder lists or for obtaining all kinds of information on the Internet, as well as for recording and analysing highly personal data such as health and fitness data. Health insurance providers, doctor’s practices and banks offer applications (‘apps’) that can be used to handle all communication with them, some of which is highly sensitive. Moreover, user devices are often not used in isolation and as local devices, but are integrated into a network of various devices and online services. When an IT system is accessed, the protection of this comprehensive data – in part highly sensitive and personality-related –, which gives rise to confidentiality expectations, is breached. This creates risks in relation to that data (cf. BVerfGE 120, 274 <305 f., 308 f., 313>; […]). In principle, the expectation of the confidentiality of IT systems persists despite the ubiquitous collection of data by private and foreign actors as a consequence of technological development ([…]) and especially comprises the expectation of confidentiality in relation to state access to IT systems ([…]).

114

State intrusion into an IT system in itself results in a breach of its integrity, compromising the confidentiality of data, regardless of the aim pursued by a surveillance measure (cf. BVerfGE 120, 274 <308, 314>; […]). After accessing the system, especially in the form of infiltrating it through surveillance software, the software can make comprehensive changes to the system or retrieve its complete memory without requiring further interim steps (cf. BVerfGE 158, 170 <184 para. 29, 187 para. 36>; […]; regarding remote searches BVerfGE 120, 274 <325>). Users can then no longer adequately protect themselves against such measures. The potential risks are particularly high if the authorities use private third parties to carry out the infiltration. The involvement of other parties naturally increases the probability of abuse and – independent of potential possibilities for oversight by the state – of unintended (further) infringements of the confidentiality or integrity of the affected systems ([…]).

115

The fundamental right protecting IT systems is tied to an IT system and provides protection to ‘particularly protected zones of privacy’ as part of the protection of the system as a whole (in this regard BVerfGE 120, 274 <331>). In structural terms, it can be compared with the guarantee of the inviolability of the home under Art. 13(1) of the Basic Law, which relates to an object; it guarantees a virtual space for the preservation and development of one’s own personality opened up by IT systems and controlled by the user in self-determination, and thus gives effect to the special need for protection arising from IT systems as such. The fundamental right is not limited to protection against access to telecommunications conducted through the use of an IT system, because it is not tied to individual forms of use, but protects the IT system as a protected space of personality that must be recognised from a fundamental rights perspective.

116

(b) By contrast, the privacy of telecommunications under Art. 10(1) of the Basic Law addresses other risks. It is designed to protect the confidentiality of remote communication processes, because the transmission of information typically cannot be controlled by the communicating parties and is therefore particularly vulnerable to access by third parties. Which communication medium is used is irrelevant in this respect. It may be an IT system, but could also be any other medium that can be used for remote communication (see para. 87 ff.).

117

While the scope of protection of Art. 10(1) of the Basic Law also includes the accessing of an IT system for the purpose of surveillance of ongoing communications (cf. also BVerfGE 141, 220 <309 para. 228>), it does not protect the legitimate expectation of the integrity and confidentiality of an IT system used as one’s own. Therefore, Art. 10(1) of the Basic Law only covers some of the potential risks resulting from the accessing of this system, which cannot be definitively appraised from today’s perspective ([…]). Yet accessing an IT system, in particular by infiltrating it with the help of surveillance software, not only breaches the integrity of the system, but also endangers its confidentiality (cf. para. 100). The system is compromised in this way if it is accessed in a manner that allows third parties to make use of its capacities, functions and stored contents (see para. 99); in this regard, there is no difference between source telecommunications surveillance and remote searches (foundationally BVerfGE 120, 274 <302 ff.>; cf. also Bundestag document, Bundestagsdrucksache – BTDrucks 16/6535, p. 8; […]). At the moment the system is accessed – the early stage of such measures, which is decisive for assessing the fundamental rights interference –, the mere intent to restrict source telecommunications surveillance to ongoing telecommunications does not lower the potential risks (cf. BVerfGE 120, 274 <308 f.>; […]). This is because this restriction can only be implemented at the next stage, the targeted diversion of data, i.e. after successful infiltration of the system (on the importance for the severity of interference cf. para. 124 f.; […]).

118

(c) The fundamental right protecting IT systems – as a guarantee protecting a separate domain of freedom with clearly defined characteristics – is therefore accorded special significance, which means that it does not yield to Art. 10(1) of the Basic Law despite the former right being derived, in terms of fundamental rights doctrine, from the general right of personality. If a matter falls within the scope of both the fundamental right protecting IT systems following from Art. 2(1) in conjunction with Art. 1(1) of the Basic Law and the privacy of telecommunications following from Art. 10(1) of the Basic Law, because a statutory power permits both the accessing of an entire IT system and the monitoring and recording of ongoing telecommunications, the two fundamental rights cumulatively form the standard of review so as to ensure comprehensive fundamental rights protection.

119

(3) Based on these standards, a measure of source telecommunications surveillance that is restricted to ongoing telecommunications – like the one at issue here in § 20c(1) first sentence no. 2 in conjunction with § 20c(2) of the Act –, insofar as the measure is directed against a target person who uses the IT system as their own, must be reviewed on the basis of both the fundamental right protecting IT systems and the privacy of telecommunications. Such a measure compromises both the protection of the infiltrated personality-related IT system and the confidentiality of the remote transmission of communications.

120

Source telecommunications surveillance cannot be treated the same as traditional telecommunications surveillance under the aspect of ‘functional equivalence’, and thus be measured solely against Art. 10(1) of the Basic Law (cf. in this regard BVerfGE 141, 220 <309 para. 228>; BTDrucks 18/12785, p. 50 ff.; […]). While source telecommunications surveillance permitted under § 20c(2) of the Act must, pursuant to § 20c(2) no. 1 of the Act, be restricted to ongoing telecommunications, just like traditional telecommunications surveillance, it would be insufficient to limit the constitutional assessment of source telecommunications surveillance to its aim and purpose alone. Even though the aim of both measures and their purpose in terms of police tactics are the same, as both serve to intercept ongoing telecommunications, the two measures differ in that source telecommunications surveillance targets communication contents that are encrypted and thus specifically secured against third-party access. Source telecommunications surveillance undermines a separate expectation of confidentiality relating to the IT system that goes beyond the confidentiality expectation regarding the communication channel as such, which is protected by Art. 10(1) of the Basic Law, and poses specific risks to this IT system.

121

Above all, the different risks concern different modes of access to communications. Traditional telecommunications surveillance is not preceded by access to an IT system, but typically by requests for information to telecommunications service providers. If the constitutional assessment of source telecommunications surveillance equated this type of surveillance with traditional telecommunications surveillance on the basis of similar aims, this would not take into account the potential risks arising from accessing the system itself, which is only necessary for source telecommunications surveillance (see para. 114 f.). Insofar as the Senate, by contrast, found in its [Federal Criminal Police Office Act I] judgment of 20 April 2016 (cf. BVerfGE 141, 220 <309 para. 228>) with regard to functional equivalence that source telecommunications surveillance, insofar as technical measures ensure that only ongoing telecommunications are affected, is not to be reviewed on the basis of the fundamental right protecting IT systems, but only on the basis of Art. 10(1) of the Basic Law (more open in this regard BVerfGE 165, 1 <85 para. 160>; but cf. also – albeit not decisive – BVerfGE 120, 274 <309>; 158, 170 <184 para. 28 f.> and/or in contradistinction to remote searches BVerfGE 162, 1 <140 para. 308>), the Senate departs from its previous case-law.

II. 

122

The interferences with fundamental rights arising from the challenged police powers are justified.

123

1. The constitutionality of the challenged surveillance powers depends on the fundamental rights affected in each case (see a) below) and, above all, on the requirements derived from the principle of proportionality (see b) below).

124

a) The constitutionality of surveillance powers first and foremost depends on the fundamental rights affected (cf. BVerfGE 162, 1 <72 para. 148, 74 para. 152>; 169, 130 <171 f. paras. 85, 88>). However, the fundamental rights do not form an abstract hierarchy, but rather typify various specific freedoms and protected interests that have been shaped by specific practical problems and historical experiences. The different protections they afford notwithstanding, the fundamental rights therefore do not form a hierarchical system in the sense that interferences with one fundamental right would always be more serious than interferences with another fundamental right. There is therefore also no categorical differentiation between interferences with the fundamental right protecting IT systems and with the privacy of telecommunications. Rather, the justification requirements for interference with all fundamental rights protecting personality rights that may be at issue here are determined primarily by the principle of proportionality, in the assessment of which the severity of the interference with the affected fundamental right must be taken into account (cf. in this regard BVerfGE 162, 1 <143 f. para. 319>; 165, 1 <48 para. 88>; […]). In this respect, interferences with fundamental rights vary widely in terms of their severity. It is true that the fundamental right protecting IT systems can only be affected if the accessing of an IT system was sufficiently serious (see para. 99) and could provide insights into important aspects of private life or allow the creation of a comprehensive personality profile (see para. 97). But even if the fundamental right protecting IT systems is only affected in case of such risks, while the privacy of telecommunications is limited to ongoing remote communication and is therefore narrower in the abstract (see para. 87 ff, 117), it is only the specific surveillance measure that ultimately determines the severity of the resulting fundamental rights interference, taking into account the risks the measure poses to freedom (cf. also BVerfGE 165, 363 <389 f. para. 54, 398 ff. para. 71 ff., 409 ff. para. 103 ff.>). Contrary to the complainants’ view, not any power that interferes with the fundamental right protecting IT systems must be measured against the strict requirements applicable to remote searches; rather, it is decisive for the severity of interference what data may ultimately be used in the context of the specific measure.

125

b) The Federal Constitutional Court has developed proportionality requirements regarding covert surveillance powers that apply across different fundamental rights (cf. BVerfGE 120, 274 <315 ff.>; 141, 220 <268 ff. para. 103 ff.>; 155, 119 <186 ff. para. 144 ff.>; 165, 1 <47 para. 85 f.>; 170, 247 <277 para. 79>). In this respect, no special treatment is accorded to interferences with the fundamental right protecting IT systems, which is subject to the three limitations set out in Art. 2(1) of the Basic Law, nor to interferences with Art. 10(1) of the Basic Law. Covert surveillance powers must pursue a legitimate purpose, and must be suitable, necessary and proportionate in the strict sense for achieving that purpose (cf. BVerfGE 141, 220 <265 para. 93> with further references). The requirements of proportionality in the strict sense in particular give rise to decisive limitations. How stringent these requirements are in each case depends on the severity of interference and the weight of the public interest (cf. BVerfGE 141, 220 <269 para. 105>).

126

Both the so-called threshold for interference, i.e. the grounds for the surveillance measure, and the legal interest to be protected by the data collection are subject to constitutional requirements (cf. in this regard BVerfGE 141, 220 <269 ff. para. 104 ff.>; 170, 247 <275 para. 74>). In relation to public security measures, it is in principle required that there is, in each individual case, either a specific danger within the meaning of the general clauses in police law (cf. BVerfGE 155, 119 <186 f. para. 146>), or at least a sufficiently identifiable danger (konkretisierte Gefahr) (cf. in this regard BVerfGE 141, 220 <271 ff. para. 111 ff.>; 155, 119 <187 ff. para. 147 ff.>). In light of the principle of proportionality, lowering the threshold for interference down to the level of a sufficiently identifiable danger will generally result in stricter requirements with regard to the specific legal interests to be protected (cf. in more detail on this issue BVerfGE 170, 247 <275 ff. para. 76 ff.> with further references). In this respect, the severity of interference resulting from a specific measure must always be taken into account (cf. in more detail on this issue BVerfGE 170, 247 <281 f. para. 93). The deeper surveillance measures reach into someone’s private life and the more they frustrate legitimate expectations of confidentiality, the stricter the justification requirements that the measures must satisfy. When it comes to public security measures, the collection of data by means of covert surveillance using particularly intrusive means is generally only proportionate if there is a sufficiently specific and foreseeable risk to sufficiently weighty legal interests in the individual case and if the person targeted by these measures appears, from the perspective of a reasonable observer examining the objective circumstances, to be involved (cf. BVerfGE 141, 220 <270 para. 108 f.> with further references; 165, 1 <49 f. para. 89 f.>).

127

2. Based on these standards, the police surveillance powers in § 20c of the Act, insofar as they have been admissibly challenged and interfere with the fundamental right protecting IT systems and Art. 10(1) of the Basic Law, or only interfere with Art. 10(1) of the Basic Law, are not objectionable under constitutional law. They satisfy the proportionality requirements.

128

a) The power under § 20c first sentence no. 2, § 20c(2) of the Act serves a legitimate purpose (see aa) below) and is suitable and necessary for achieving that purpose (see bb) below).

129

aa) The power under § 20c(1) first sentence no. 2, § 20c(2) of the Act serves the legitimate purpose of preventing terrorist acts within the meaning of § 8(4) of the Act, including prior to the emergence of a specific danger (cf. also BVerfGE 120, 274 <319>). The power to carry out telecommunications surveillance and source telecommunications surveillance provides the police authorities with means of investigation which enable them to obtain access to encrypted communication contents in particular (cf. in this respect LTDrucks NRW 17/2351, p. 36). Especially given the Land legislator’s presumption that the abstract threat level is high in light of terrorist and organised crime (cf. LTDrucks NRW 17/2351, pp. 1, 27) and given the increasing use of modern, encrypted means of communication, the power at issue makes both public security measures and the early prevention of crime more effective. Putting in place effective surveillance measures is a legitimate aim (cf. BVerfGE 169, 332 <374 para. 101>). Both the security of the state, as a constituted power of peace and order, and the security of the population it is bound to protect are constitutional values that rank equally with other constitutional interests of high standing. The state is therefore required to protect the life, physical integrity and liberty of the individual. Above all, this means that individuals must be protected from unlawful encroachments by others (cf. BVerfGE 141, 220 <267 f. para. 100>; 169, 332 <370 para. 91>; established case-law).

130

bb) The power under § 20c(1) first sentence no. 2, § 20c(2) of the Act is suitable and necessary under constitutional law to achieve this aim. The challenged provisions provide police authorities with means of investigation that can help counter dangers to legal interests protected by the police at an early stage. It is not ascertainable that there are less restrictive means that would allow for equally far-reaching investigations. At the same time, it must be ensured, in each individual case, that these powers only be exercised in accordance with the principle of suitability and necessity (cf. BVerfGE 141, 220 <266 f. para. 97>).

131

b) Insofar as it has been admissibly challenged, § 20c of the Act satisfies the requirements of proportionality in the strict sense, including with regard to the severity of interference it entails. The power under § 20c(1) first sentence no. 2, § 20c(2) is limited to the protection of sufficiently weighty legal interests by making reference to the terrorist offences laid down in § 8(4) of the Act with regard to both telecommunications surveillance and source telecommunications surveillance.

132

Covert measures of telecommunications surveillance with at least severe effects (cf. in this regard BVerfGE 113, 348 <382>; 129, 208 <240>; 141, 220 <310 para. 229>) are only permissible for the protection or defence of especially weighty (high-ranking) legal interests (cf. BVerfGE 141, 220 <270 f. para. 108, 272 para. 112>; 165, 363 <410 para. 105, 430 para. 151>), particularly if the statutory threshold for interference shifts protection to a precautionary stage before a specific danger arises, as in the present case (see paras. 9, 126). When it is taken into account that different legislative techniques are available to limit surveillance powers to the necessary protection of legal interests, especially when it comes to public security measures (see aa) below), § 20c(1) first sentence no. 2 of the Act limits surveillance measures to the protection of especially weighty legal interests by making reference to the terrorist offences set out in § 8(4) of the Act (see bb) below).

133

aa) Various legislative techniques are available to the legislator to ensure the necessary weight of protected legal interests when determining the prerequisites for interference for data collection measures.

134

(1) With measures that serve law enforcement purposes, which are repressive in nature, the seriousness of the relevant criminal offence is the key factor. The legislator has divided such criminal offences into different categories – considerable, serious and particularly serious criminal offences – and has defined each category in greater detail (BVerfGE 141, 220 <270 para. 107>; in more detail BVerfGE 169, 130 <218 ff. para. 201 ff.>). For instance, the acoustic surveillance of private homes requires the suspicion of a particularly serious crime (Art. 13(3) of the Basic Law; cf. BVerfGE 109, 279 <343 ff.>), telecommunications surveillance requires the suspicion of a serious crime (cf. BVerfGE 125, 260 <328 f.>; 129, 208 <243>), while observation by means of a GPS tracker requires the suspicion of a considerable crime (cf. BVerfGE 107, 299 <321 f.>; 112, 304 <315 f.>; 141, 220 <270 para. 107>).

135

(2) (a) With measures that serve to avert dangers to public security, which are preventive in nature, by contrast, the key factor is the weight of the legal interests that the measures serve to protect (cf. BVerfGE 125, 260 <329>). Covert surveillance measures that reach deep into a person’s private life are only permissible to protect particularly weighty legal interests. These include life, limb and liberty of the person as well as the existence or security of the Federation or a Land (cf. BVerfGE 120, 274 <328>; 125, 260 <330>; 141, 220 <270 para. 108>). Covert surveillance measures may also be justified by the protection of assets of substantial value, the preservation of which is required in the public interest. This must be narrowly interpreted as meaning significant infrastructure facilities or other sites that are vital for society (cf. BVerfGE 141, 220 <270 f. para. 108, 272 para. 112>; 165, 1 <93 para. 179>; 169, 130 <182 para. 108>; 170, 79 <141 para. 176 f.>).

136

(b) However, the legislator need not directly state the necessary legal interest, and may instead tie the powers to criminal offences that the powers serve to prevent (cf. BVerfGE 165, 1 <93 para. 179>; 165, 363 <410 para. 105> each with further references; for data sharing powers BVerfGE 141, 220 <332 para. 300>; 162, 1 <115 para. 244>; 163, 43 <102 para. 154> – Federal Protection of the Constitution Act – Data sharing powers; still sceptical in BVerfGE 125, 260 <329 f.>; 154, 152 <269 para. 221>). The legislator can ensure the necessary weight of protected legal interests in the area of preventive public security measures by linking the authorisations for such measures to sufficiently severe criminal offences (see (aa) below) or by additionally considering the legal interests at issue or by introducing sufficient standards for the qualification of a criminal act as a terrorist offence in an individual case – irrespective of the seriousness of the criminal offence as such (see bb) below).

137

(aa) If the legislator does not directly state the legal interest to be protected, but ties powers to criminal offences, these must be serious. The constitutional requirement of a particularly weighty legal interest corresponds to a restriction to particularly serious criminal offences in the constitutional sense, i.e. offences that carry a maximum penalty of more than five years imprisonment (cf. also BVerfGE 165, 1 <93 para. 179>; in more detail BVerfGE 169, 130 <219 para. 203> each with further references). Yet in principle, a criminal offence that carries a maximum penalty of at least five years imprisonment can also be classified as a particularly serious criminal offence if this appears justified not only with regard to the protected legal interests and their importance to society, but also with regard to the way in which the criminal act was committed and its consequences (in more detail BVerfGE 169, 130 <219 f. para. 205>). In determining particularly serious criminal offences, the legislator is not limited to constituent elements that must be classified as felonies (Verbrechen) within the meaning of § 12 of the Criminal Code. The inclusion of misdemeanours (Vergehen) in the catalogue of criminal offences is also permissible if the elements of the crime fulfil the criterion of being a particularly serious criminal offence (BVerfGE 169, 130 <220 para. 207> with further references).

138

(bb) When it comes to preventive measures, the legislator can, irrespective of the seriousness of the criminal offence, also ensure the necessary weight of protected legal interests by additionally considering the legal interests at stake or by introducing sufficient standards for the qualification of a criminal act as a terrorist offence in an individual case, like in § 129a(1) and (2) of the Criminal Code (cf. regarding data sharing powers BVerfGE 141, 220 <332 para. 300>). In this regard, the Senate departs from its previous case-law at least insofar as it conflicts with these considerations, namely with regard to criminal offences with a maximum penalty of up to three years imprisonment (cf. BVerfGE 165, 1 <92 f. para. 178 ff.>; cf. also for data sharing powers BVerfGE 154, 152 <304 f. para. 312>; 163, 43 <102 para. 155>). It is sufficient that the criminal offences listed by the legislator either directly target, in a sufficiently qualified manner, life, limb or liberty of the person or the existence and security of the Federation or of a Land, or if their unlawfulness stems from the danger of the commission of the crime for such legal interests or if they concern assets of substantial value in the form of significant infrastructure facilities, the preservation of which is required in the public interest – this is the case, for example, for crimes endangering the general public. If the legislator does not explicitly align a criminal provision with the protection of such especially weighty legal interests, it can also ensure the necessary weight of the protected legal interest by requiring that the criminal offences referenced in the statutory police power must serve the protection of such legal interests in the individual case. This may especially be the case for criminal offences that are classified as terrorist offences (cf. regarding the corresponding determination of tasks BVerfGE 141, 220 <332 para. 300>). The circumstances in which this is the case are determined in detail in § 129a(1) and (2) of the Criminal Code and limited to specifically defined, characteristic criminal offences of particular seriousness (cf. BVerfGE 169, 332 <374 para. 101>). Criminal acts that qualify as terrorist offences aim to destabilise society and are directed against the pillars of the constitutional order and society in its entirety (cf. BVerfGE 141, 220 <266 para. 96>). Preventing them is an especially significant state task.

139

bb) § 20c(1) first sentence no. 2 of the Act thus limits telecommunications surveillance and source telecommunications surveillance to the protection of sufficiently weighty legal interests. The challenged power permits the surveillance of persons whose individual conduct establishes a specific probability that they will commit a terrorist offence pursuant to § 8(4) of the Act in the foreseeable future and it is at least possible to determine how this offence will be committed. This ensures that the power may only be used to protect high-ranking legal interests.

140

(1) The present use of a catalogue of criminal offences for ensuring the necessary weight of protected legal interests does not raise constitutional concerns in itself (see para. 136). This also applies if – as in the present case – police authorities are authorised to carry out surveillance measures before a specific danger arises (cf. also BVerfGE 113, 348 <377 f.>; 141, 220 <290 f. para. 163 ff.>).

141

(2) The powers to carry out telecommunications surveillance and source telecommunications surveillance are limited to the protection of sufficiently weighty legal interests through the reference to the terrorist offences specified in § 8(4) of the Act.

142

(a) Insofar as the criminal offences listed in § 8(4) first half-sentence of the Act, such as § 303b(4) of the Criminal Code (especially serious cases of computer sabotage), § 315(1) and (3) of the Criminal Code (dangerous interference with rail, ship and air traffic) or § 316b(3) of the Criminal Code (especially serious disruption of public services) carry a maximum penalty of at least ten years imprisonment, they constitute particularly serious crimes. The legal interests protected by them are sufficiently weighty from the outset (see para. 137).

143

(b) In addition, many of the criminal offences listed in § 8(4) first half-sentence of the Act concern crimes that directly threaten life and limb or meet the narrow requirements for the protection of material assets (see para. 135). But even where this is not the case, the necessary weight of the protected legal interests is safeguarded by the fact that surveillance for the purpose of preventing any of the criminal offences listed in § 8(4) first half-sentence of the Act is only permissible if, in an individual case, the criminal offence in question meets the standards of a terrorist offence as specified in § 8(4) second half-sentence of the Act. This ensures that high-ranking legal interests are protected (see para. 138). The definition of the term ‘terrorist offence’ by the legislator in North Rhine-Westphalia does not raise concerns in this regard. Following § 129a(1) and (2) of the Criminal Code, whose wording, in turn, implements Art. 1 of the EU’s Council Framework Decision 2002/475/JHA of 13 June 2002 (OJ L 164, p. 3; cf. BTDrucks 15/813, p. 7) and the provision succeeding it, Art. 3 of Directive (EU) 2017/541 of the European Parliament and of the Council of 15 March 2017 on combating terrorism and replacing Council Framework Decision 2002/475/JHA and amending Council Decision 2005/671/JHA (OJ L 88 p. 6), § 8(4) first half-sentence of the Act lists criminal offences that can be qualified as terrorist offences if they, in accordance with § 8(4) second half-sentence of the Act, are tied to especially reprehensible subjective aims or are objectively capable of inflicting particular harm. In order to be qualified as terrorist offences, these offences must serve to seriously intimidate the population, to unlawfully coerce an authority or an international organisation by force or threat of force or to destroy or significantly impair the fundamental political, constitutional, economic or social structures of a state or of an international organisation. They must also be capable of seriously damaging a state or an international organisation given their nature or consequences. The legislator therefore did not merely reference terrorism as an indeterminate legal concept; rather, it provided that surveillance measures may only be carried out to prevent specifically defined, characteristic criminal offences of particular seriousness. This definition of terrorism pursuant to § 8(4) second half-sentence of the Act is constitutionally tenable (cf. regarding § 4a(1) second sentence of the Federal Criminal Police Office Act (former version), which had the same content, BVerfGE 141, 220 <266 para. 96, 288 para. 156, 331 para. 298>; cf. also § 5(1) second sentence of the Federal Criminal Police Office Act BVerfGE 169, 332 <374 para. 101>).