Bundesverfassungsgericht

You are here:

Provisions of Telecommunications Act on storage and use of telecommunications data unconstitutional in part

Press Release No. 13/2012 of 24 February 2012

Order of 24 January 2012
1 BvR 1299/05

The constitutional complaint challenges §§ 111 to 113 of the Telecommunications Act (Telekommunikationsgesetz - TKG).

1. § 111 TKG imposes a duty on commercial providers of telecommunications services to collect and store the telecommunications numbers (telephone numbers, line identification numbers, mobile end device numbers and identifiers of email accounts) which they allocate or provide and the related personal data such as names, addresses and dates of birth.

§§ 112, 113 TKG create the basis for two different procedures to supply information from the data stored under § 111 TKG. In the automated procedure governed by § 112 TKG, the providers of telecommunications services must supply the data in such a way that they can be accessed by the Federal Network Agency (Bundesnetzagentur) without the providers having notice of this. The Federal Network Agency must retrieve the data on the application of specifically designated authorities, including in particular the criminal prosecution and law enforcement authorities, using the automated procedure, and communicate it to them. The information may always be given if it is necessary to comply with statutory obligations.

The manual procedure governed by § 113.1 sentence 1 TKG, in contrast, imposes on the telecommunications enterprises themselves a duty to supply information. It is not only the suppliers who offer telecommunications services to the public (e.g. telephone companies and providers) who have a duty to provide information, but also all those who provide telecommunications services on a commercial basis (including, for example, hospitals, or if applicable hotels). Under this provision, all authorities are in principle entitled to receive information. It is a requirement that in the individual case the information is needed to prosecute criminal offences and regulatory offences, to avert dangers or for intelligence activities.

§ 113.1 sentence 2 TKG creates a special duty to provide information with regard to access codes such as passwords or personal identification numbers (PINs). In this connection, those entitled to receive information include the criminal prosecution authorities and the security and intelligence services.

In the interpretation of § 113 TKG, there is a widespread but controversial practice of giving information in addition on the holder of what is known as a dynamic Internet Protocol address (dynamic IP address). These are the telecommunications numbers under which above all private persons surf the internet.

The retrieval of the data by the authorities entitled to receive information is governed by their own legal basis; in practice, a legal basis which gives the authorities a general power to collect data has been regarded as sufficient.

2. The complainants use prepaid mobile phone cards and internet access services and assert that their fundamental rights are violated by the storage of their data and the potential communication of these in the information procedures.

3. The First Senate of the Federal Constitutional Court held that the collection and storage of telecommunications data under § 111 TKG and their use in the automated information procedure governed by § 112 TKG are constitutional. The encroachment upon the right to informational self-determination effected by this is of only limited weight, and is justified in view of the aim of improving the state's performance of its duties. In this connection, the general data retrieval regulations of the authorities entitled to retrieve are also sufficient.

The constitutional complaint is also unsuccessful insofar as it challenges the provisions contained in § 113.1 sentence 1 TKG for the telecommunications service providers to give general information in the manual information procedure. However, the provision must be interpreted in conformity with the Basic Law (Grundgesetz - GG) to the effect that special enabling legislation is required for data retrieval. In addition, § 113.1 sentence 1 TKG does not permit dynamic IP addresses to be attributed to persons. For a transitional period, until 30 June 2013 at the latest, the provision may be applied without these conditions.

However, § 113.1 sentence 2 TKG is not compatible with the right to informational self-determination. But the provision is to continue in effect on an interim basis, until 30 June 2013 at the latest, provided that the access codes may be collected only subject to the conditions which, under the applicable provisions in each case (for example the provisions of criminal law), govern their use.

In essence, the decision is based on the following considerations:

I. The provisions challenged are in essence to be measured against the right to informational self-determination under Article 2.1 in conjunction with Article 1.1 GG. The duties of the service providers laid down in §§ 111 to 113 TKG to collect, store and supply the data, just like the power of the Federal Network Agency to access these data and to communicate them, or like the power of the telecommunications providers to give information, are in each case independent encroachments upon this fundamental right. In addition, there is a further independent encroachment on fundamental rights in the retrieval of the data, which requires a separate legal basis apart from §§ 112, 113 TKG. Thus, there must be corresponding legal bases for the retrieval and for the supply of information, and these act together like double doors.

In contrast, the challenged provisions - as long as they are not used to attribute dynamic IP addresses - do not encroach upon the secrecy of telecommunications of Article 10.1 GG. This fundamental right only protects the confidentiality of specific telecommunications events, but not the confidentiality of the relevant circumstances of the provision of telecommunications services. The storage and supply of information ordered in §§ 111 to 113 TKG relates solely to the abstract attribution of telecommunications numbers to particular subscribers, and just like the attribution of a static IP address to a user, this is not within the area of protection of Article 10 GG.

In contrast, the attribution of dynamic IP addresses is an encroachment upon the secrecy of telecommunications. For in order to identify a dynamic IP address, the telecommunications enterprises must examine the relevant connection data of their customers and thus access specific telecommunications events which fall within the area of protection of Article 10 GG.

II. The duty of storage of § 111 TKG is constitutionally unobjectionable. It serves to maintain a reliable data basis for the supply of information governed by §§ 112, 113 TKG, which permits particular authorities to attribute telecommunications numbers to individual subscribers. The improvement of the state's performance of its duties aimed at by this, above all in the area of the prosecution of criminal offences, the averting of dangers and intelligence activities, is a legitimate purpose which justifies the encroachment upon fundamental rights. § 111 TKG provides for a selective retention of particular data, restricted in their scope and with a precisely defined information content, for the purposes defined in detail in §§ 112, 113 TKG; this does not violate the strict prohibition of data retention.

§ 111 TKG is not disproportionate. In view of the information content of the data collected, which is not very extensive, this is an encroachment of limited weight. The data do not of themselves provide information on specific activities of individuals, but merely make it possible to individually attribute telecommunications data numbers to the subscribers in question. In a fundamentally different way than in the case of precautionary storage of all telecommunications traffic data, neither do these data as such contain highly personal information, nor is it possible to use them to create personality profiles or track users' movements. Nor does § 111 TKG cover dynamic IP addresses. The possibility of attribution of the data collected in § 111 TKG serves the effective performance of the duties of the authorities defined in more detail in the provisions on use. It is constitutionally justified by the fact that the state may have a legitimate interest in successfully investigating particular telecommunications events if occasion arises, and this interest in the performance of particular tasks may have considerable weight, in individual cases even pre-eminent weight.

III. The automated information procedure under § 112 TKG is also compatible with the constitution. The provision is the legal basis for the duty of service providers to supply the data as a customer file and for access to these data by the Federal Network Agency and their communication to the authorities entitled to receive information. For the retrieval of the data by the authorities, § 112 TKG, by analogy with the "double door" model, requires independent enabling legislation; the general data collection provisions of the relevant authorities entitled to receive information are sufficient.

1. § 112 TKG does not violate the system of competencies of the Basic Law. The Federal legislature was entitled to legislate for the automated information procedure on the basis of its competence for telecommunications law under Article 73.1 no. 7 GG. This also includes passing legislation on data protection in this area and at the same time establishing when an authority may communicate data despite these requirements of data protection law. In contrast, its legislative competence ends where the retrieval of such information is concerned. The authorisations to retrieve data themselves require an independent legal basis from the Federal legislature or else they are given by the Länder (states). Since § 112 TKG only governs data exchange between authorities, there are no objections in the law relating to competence to the Federal legislature passing legislation on the information procedure with the effect that all that remains for the Länder to do is to provide general data collection provisions for data retrieval, for the right of the Länder to make the final decision on whether and how data is to be retrieved is unaffected.

2. § 112 TKG satisfies the requirements of the principle of proportionality. The provision serves to improve the effectiveness of the state's performance of its duties. The purposes for which the authorities are given information under § 112.2 TKG are central duties relating to the guarantee of security. In view of the importance of electronic means of communication in all areas of life, the authorities depend on being able to attribute telecommunications numbers individually. It is constitutionally unobjectionable for the legislature to permit the communication of these data in order that criminal offences and dangers are investigated, to observe developments which endanger the constitution in order for the government and the public to be informed or for assistance to be given in emergencies. Nor is the provision disproportionate in the present state of technological development and practice on the grounds that in certain circumstances it makes it possible to identify static IP addresses, for since at the present time these are as a general rule allocated only to institutions and major users, but not to private users as individual customers, the possibility of retrieving such numbers has little weight. But the legislature does have a duty to observe and where appropriate to correct in this connection. However, § 111 TKG does not cover dynamic IP addresses, and therefore § 112 does not enable these to be de-anonymised. IV. The manual information procedure under § 113.1 sentence 1 TKG is also compatible with the constitution.

1. But in two respects the provision needs to be interpreted in conformity with the constitution. a) Firstly, it must be interpreted for reasons of the law relating to competence and also for constitutional reasons in such a way that it in itself alone does not create duties of information of the telecommunications enterprises. Since these are duties of information of private individuals, the authorities entitled to receive information need separate enabling legislation under special law, if appropriate under Land law, in order to retrieve the data; this legislation must be independent and have clear definitions and must create an obligation of the telecommunications service providers to the authorities entitled to retrieve. For in the law relating to competence, creating a duty of information of private persons is not part of the definition of the purposes of the communication, but part of the retrieval. It follows from the principle of clear statutory definition that it must be sufficiently clearly laid down in this connection which authorities the providers are specifically to be obliged to inform.

b) Secondly, the provision may not be used to attribute dynamic IP addresses. This is not permitted inter alia because the attribution of dynamic IP addresses must be defined as an encroachment upon Article 10.1 GG. Such encroachments are subject to the citation requirement of Article 19.1 sentence 2 GG which requires the legislature to name the fundamental right upon which an encroachment is made and to state the number of the Article in which it is contained. This is lacking in the present case. Apart from this, § 113.1 TKG does not define with sufficient clarity whether it is also to permit an identification of such addresses, which has its own weight.

2. On the basis of the above stipulations, § 113.1 sentence 1 TKG satisfies the requirements of the principle of proportionality. In view of the limited information content of the data in question and their great importance for an effective performance of duties, the reach of the provision is constitutionally unobjectionable. It by no means enables information to be given indiscriminately as a general means of lawful administrative enforcement, but requires that the measure be necessary in the individual case in order to discharge a duty of a security nature. The broad range of persons obliged to give information is also justified in view of the aim of making investigations more effective.

V. In contrast, the provision of § 113.1 sentence 2 TKG violates the fundamental right to informational self-determination because it does not satisfy the requirements of the principle of proportionality. The provision relates to the access codes which protect the access to end user devices and thus protect the persons in question against access to the data or telecommunications events involved. But access to these data is not necessary in the degree provided by § 113.1 sentence 2 TKG for these authorities to perform their duties effectively. The provision makes these data accessible to the authorities and thus puts the authorities in the position to surmount the relevant barriers, but it does not legislate on the requirements for the use of these codes. On the contrary, as is made clear by § 113.1 sentence 3 TKG, these requirements are solely to be defined by independent legal provisions in non-constitutional law, for example by the relevant provisions of the Code of Criminal Procedure (Strafprozessordnung - StPO). But no reason is apparent for the authorities to be able to retrieve the access codes governed by § 113.1 sentence 2 TKG independently of the requirements for their use and thus in some circumstances subject to less stringent conditions. The collection of the access data governed by § 113.1 sentence 2 TKG, in view of the purposes pursued there, is necessary only if the requirements for their use are also satisfied. The provision of § 113.1 sentence 2 TKG does not sufficiently ensure this in its present wording.

VI. The Federal Constitutional Court did not declare the unconstitutional provision of § 113.1 sentence 2 TKG null and void, but ordered that it should continue in effect for an interim period subject to the proviso that the security services may only require information on access codes such as PINs and PUKs if the statutory requirements for their use are satisfied. For if the provision were declared null and void, the result would be that even in the cases in which the authorities are lawfully entitled to have access to telecommunications data to prevent or punish serious violations of legal interests it would not be sufficiently ensured that they were in the position to do this. In view of the limited weight of the encroachment upon fundamental rights, this would not be acceptable even for an interim period. For the same reasons, a transitional arrangement is necessary with regard to the constitutional requirements of the interpretation of § 113.1 sentence 1 TKG. If these requirements came into effect immediately, there would be a large number of cases in which neither would information on telecommunications numbers be possible nor could dynamic IP addresses be identified until new retrieval rules were issued in non-constitutional law.