You are here:
Constitutional complaints against the investigative powers of the Federal Criminal Police Office for fighting international terrorism partially successful
Press Release No. 19/2016 of 20 April 2016
Judgment of 20 April 2016
1 BvR 966/09, 1 BvR 1140/09
In its judgment rendered today, the First Senate of the Federal Constitutional Court decided that the authorisation of the Federal Criminal Police Office (Bundeskriminalamt – BKA) to carry out covert surveillance measures in order to protect against threats from international terrorism is, in principle, compatible with fundamental rights under the German Basic Law. In some respects, however, the current design of the investigative powers does not satisfy the principle of proportionality. Consequently, the Federal Constitutional Court ruled various provisions within the overall legal structure unconstitutional. Consolidating long-established case-law, the decision addresses the legal requirements for carrying out covert surveillance measures, as well as the issue of the transfer of data for other purposes to third-party authorities, and finally, for the first time, the requirements for the transfer of data to authorities in third countries.
With regard to the legal requirements for carrying out covert surveillance measures, the provisions introduced in 2009 are in part too unspecific and too broad. Some also lack supplementary rule-of-law safeguards, particularly safeguards protecting the core area of private life or guaranteeing transparency, individual legal protection and judicial review. Numerous parts of the provisions concerning the transfer of data lack – both with respect to authorities in Germany as well as in third countries – sufficient legal restrictions. Since the grounds for the unconstitutionality do not affect the core of the powers granted, the objectionable provisions will mainly remain in force, subject to restrictions, up to and including 30 June 2018.
In parts, the decision was not adopted unanimously; Justices Eichberger and Schluckebier delivered separate opinions.
Facts of the Case:
The constitutional complaints challenge certain powers which were introduced into the Federal Criminal Police Office Act (Bundeskriminalamtgesetz – BKAG) in 2009. The federal legislature thus assigned to the Federal Criminal Police Office tasks extending beyond its previous law enforcement duties and reaching into the domain of the protection against threats from international terrorism, which until then had been a task assigned to the Laender (federal states). An additional subject of the constitutional complaints concerns the previously existing rules in the Federal Criminal Police Office Act on the transfer of data to third countries, the scope of which has been extended by the newly attributed powers.
Further information on the background of the case can be found (in German) in Press Release no. 43/2015 of 16 June 2015.
Key Considerations of the Senate:
1. The challenged powers authorise the Federal Criminal Police Office to covertly collect personal data in the context of the protection against threats from international terrorism and the prevention of criminal offences and allow – depending on the respective power – interferences with the fundamental rights of the inviolability of the home, of the secrecy of telecommunication and of informational self-determination, as well as the fundamental right to the confidentiality and integrity of information technology systems. It is the legislature’s task to find a balance between the severity of interferences with fundamental rights on the one hand and the duty of the state to protect the population on the other. It must be considered, on the one hand, that the challenged powers for the most part authorise serious interferences with privacy, and, in specific cases, can even intrude into private refuges, whose protection is of particular significance for the safeguarding of human dignity. On the other hand, it needs to be considered that effective means of gathering information are of great importance for protecting against threats emanating from international terrorism to the democratic and free basic order and for the protection of fundamental rights. In this respect, the safety of the state, as a constituted power of peace and order, as well as the safety of the population it is bound to guarantee – all the while respecting the dignity and the intrinsic value of the individual – rank equally with other highly valued constitutional rights.
2. This decision fundamentally consolidates the existing case-law on the relevant constitutional requirements for achieving this balance. It shows that the powers attributed to the Federal Criminal Police Office are, in principle, not objectionable. However, stemming from the principle of proportionality, these powers are subject to overarching requirements in cases in which they – as most of them do – authorise serious interferences with privacy. In particular, the powers must be restricted to the protection of sufficiently weighty legally protected interests and are constitutional only in those cases in which there is a sufficiently specific foreseeable danger to these interests. Only under limited conditions may the investigative powers also extend to persons from whom the threat does not emanate and who belong to the target person’s sphere. With regard to powers which typically lead to interference with the strictly protected core area of private life, particular protective rules are needed. Sufficient protection of persons subject to professional confidentiality is also required. Moreover, the powers are subject to constitutionally required standards of transparency, individual legal protection and judicial review. Stemming from these standards are duties to inform the affected parties after the measures have been carried out, powers of judicial review, supervisory control on a regular basis, as well as reporting requirements vis-à-vis the Parliament and the public. Finally, these investigative powers must be supplemented by requirements to delete the recorded data.
3. In various respects, the challenged provisions do not meet these requirements.
a) The provisions on the use of special means of surveillance outside of homes, such as observation, audio and visual recording, the application of tracking devices or the use of police informants, are not sufficiently limited (§ 20g secs. 1 to 3 BKAG).
aa) The legislature opens such measures not only for the purpose of protecting against specific threats, but also for the prevention of crimes (§ 20g sec. 1 no. 2 BKAG). This approach is, in principle, permissible, but is subject to limits to which the provision does not adhere. The provision neither stipulates the requirement that an incident be present which is specific and foreseeable at least with regard to its nature, nor, alternatively, that the individual behaviour of a person substantiate the specific probability that he or she will commit terrorist offences in the near future. Thus, § 20g BKAG does not provide the authorities and the courts with sufficiently defined criteria to work with and allows measures which may be disproportionately broad.
bb) § 20g BKAG allows measures which can in part typically result in the monitoring of confidential situations – situations from which the state is strictly excluded. Thus, in order to safeguard the core area of private life both with respect to data collection and to data analysis, the legislature must provide protective provisions. These, however, are lacking here.
cc) Furthermore, to the extent that it relates to longer term monitoring or non-public conversations, the requirement of a judicial decision in § 20g sec. 3 BKAG is poorly designed, given that some of the measures are not at all subject to a prior judicial order, while other measures require a judicial order only after one month.
b) The provision on the surveillance of private homes (§ 20h BKAG), which allows data collection in the form of visual as well as acoustic surveillance, only partially satisfies the requirement of proportionality.
aa) The authorisation of the surveillance of private homes with a view to contact or accompanying persons (§ 20h sec. 1 no. 1 c BKAG) is not compatible with Art. 13 secs. 1 and 4 Basic Law (Grundgesetz – GG). The surveillance of private homes constitutes a particularly serious interference with privacy. Therefore, such a surveillance measure is only appropriate if it focusses exclusively on the communications of the target person from whom the threat emanates. Unlike other measures, this type of surveillance cannot be ordered to directly target third parties. However, this is not to say that third parties cannot be indirectly affected by such a measure.
bb) The provision for the protection of the core area of private life in § 20h sec. 5 BKAG is constitutionally insufficient. Since the surveillance of private homes can constitute a serious interference with privacy, the requirements of core area protection are strict. After such a measure has been carried out – with the exception of cases of immediate danger – all data must first be examined by an independent body, to verify whether it contains highly private information, before it can be used by the Federal Criminal Police Office. The provision, however, does not ensure that this is the case.
c) Sufficient protection of the core area of private life is lacking with regard to access to information technology systems (§ 20k BKAG). In this case, the body tasked with viewing the collected data is not sufficiently independent. It is necessary that the control essentially be carried out by external persons not charged with security tasks. While the recourse to personnel from the Federal Criminal Police Office for the purpose of involving staff with investigation-specific or technical expertise is not ruled out, the actual carrying out and decision-making responsibility must lie in the hands of persons independent from the Federal Criminal Police Office. By attributing the task of screening mainly to employees of the Federal Criminal Police Office, however, § 20k sec. 7 sentences 3 and 4 BKAG falls short of these requirements.
d) The provision on the surveillance of on-going telecommunications (§ 20l BKAG) is only partially compatible with the Constitution. In particular, the provision extending the scope of telecommunications surveillance to the prevention of criminal offences is too unspecific and disproportionately broad. This shortcoming is also found in the provision on the collection of telecommunications traffic data (§ 20m secs. 1 and 3 BKAG).
e) All of the challenged investigative and surveillance powers are lacking supplementary provisions, without which the proportionality of the challenged investigative and surveillance powers is not satisfied.
aa) The protection of persons subject to professional confidentiality is not viably designed, since a distinction is made between defence counsel and other lawyers. Since the surveillance measures in question do not pursue the aim of prosecuting offences but of protecting against threats, such a distinction is not suitable for protecting legal counsel.
bb) The provisions aiming to guarantee transparency, legal protection and judicial review do not completely satisfy the constitutional requirements. They lack adequate specifications on regular mandatory review, on a comprehensive documentation requirement which allows the full and effective review of the surveillance measures in question, and on reporting duties vis-à-vis Parliament and the public.
cc) The obligations to delete the collected data also only partially satisfy constitutional requirements. It is unconstitutional that there is a possibility that the deletion of collected data, once it has served its purpose, can in general be avoided on the grounds that the data is needed for law enforcement or for the prevention of crimes or as a precaution for the future prosecution of a criminal offence of considerable significance (§ 20v sec. 6 sentence 5 BKAG). This possibility thus permits the storage of data in view of new, only generally circumscribed uses for which the Act does not and, in this broadness, in fact cannot provide any legal basis. The very brief safekeeping period for the deletion protocols drawn up by the Federal Criminal Police Office is also not viable, as it does not sufficiently ensure the possibility of review at a later time.
4. The decision, leaning on existing case-law, develops new distinctions for conditions on the use of data extending beyond the original investigation procedure. The principles of purpose (Zweckbindung) and change in purpose (Zweckänderung) are relevant here. The generally permissible further use of data within the context of its original data collection purpose is to be distinguished from a change in purpose, which is only permissible within certain limits.
a) The legislature may permit the use of data extending beyond the original investigation procedure in the context of the original purpose of this data (further use), provided that the authority empowered to collect that data uses it within the same field of activity, for the protection of the same legally protected interests, and the enforcement or prevention of the same criminal offences, as authorised by the relevant data collection provision. It does not contradict the principle of purpose when the further use of data as a mere evidentiary basis for further investigations is permitted. However, the same does not apply for data originating from the surveillance of private homes or from access to information technology systems. Due to the severity of these interferences, every further use of such data must also fulfil the risk situation requirements needed for the initial data collection.
b) Moreover, the legislature may also permit the use of the data for purposes other than the purpose of the initial data collection (change in purpose). The proportionality requirements for such a change align on the principle of a hypothetical re-collection of data. Accordingly, the new use of the data must serve the protection of legally protected rights or aim to investigate criminal offences of such a weight that, by constitutional standards, collecting them again by comparably weighty means would be justified. A specific danger, which is required for the initial data collection, is generally not required a second time; it is necessary but generally also sufficient that there be a specific evidentiary basis for further investigations. Due to the particular severity of the interference that the surveillance of private homes and remote searches of information technology systems constitute, a change in purpose with regard to such measures is only permitted if the risk situation requirements applicable to the collection of the data are again fulfilled. With this specification, the decision consolidates a long line of case-law and carefully delimits it.
5. The provisions on the use and transfer of data to domestic authorities only partially satisfy these principles.
a) The fact that the Federal Criminal Police Office may use the data obtained, in principle irrespective of specific dangers, to carry out its function of protecting against threats from international terrorism (§ 20v sec. 4 sentence 2 no. 1 BKAG) does not raise concerns. However, this power is disproportionate with regard to data from the surveillance of private homes and remote searches. Due to the severity of the interference, a further use may only be permitted in cases where an imminent danger or a sufficiently specific risk situation is once again present.
In contrast, the statutorily unlimited power of the Federal Criminal Police Office to further use the data for the protection of witnesses or other persons (§ 20v sec. 4 sentence 2 no. 2 BKAG) is too unspecific and does not satisfy the constitutional requirements.
b) The powers to transfer data to other domestic authorities (§ 20v sec. 5 BKAG) are unconstitutional.
The transfer of data for the protection against threats is unconstitutional insofar as it allows a transfer for the general prevention of terrorist offences, irrespective of a specific evidentiary basis for further investigations. The provision on the transfer for data for law enforcement purposes is not compatible with the Constitution. The referenced provisions of the Code of Criminal Procedure (§ 161 secs. 1 and 2 Strafprozessordnung – StPO) neither sufficiently ensure the constitutionally required limitation of data transfer, nor do they ensure that the transfer of data from the surveillance of private homes or remote searches is limited to the purpose of prosecuting sufficiently serious criminal offences; the provision also does not rule out the transfer of data from the visual surveillance of private homes to law enforcement authorities, although pursuant to Art. 13 secs. 3 and 4 GG, such visual surveillance is only permitted with regard to the protection against threats, but not with regard to criminal prosecution. The powers for transferring data to offices for the protection of the Constitution, the Military Counterintelligence Agency and the Federal Intelligence Service are disproportionately broad (§ 20v sec. 5 sentence 3 no. 1, sentence 4 BKAG).
Furthermore, with respect to all transfer powers, the relevant requirements, which also apply here, for an effective review by the Federal Data Protection Commissioner are not sufficiently guaranteed.
6. The decision contains fundamental statements on the requirements for the transfer of data to security authorities in third countries. It is the first time the Federal Constitutional Court has been called upon to decide on this matter. The decision, however, does not pertain to transfers to Member States of the European Union (§ 14a BKAG).
The result of a transfer of data to third countries is that, after the transfer, the guarantees of the Basic Law can no longer be applied as such and the standards prevailing in the respective receiving country apply instead. This does not, however, fundamentally prevent a transfer to third countries. The Basic Law’s alignment towards international cooperation encompasses the respect for foreign legal orders and conceptions. In deciding whether to transfer personal data to third countries, the exercise of German state authority remains bound to uphold the fundamental rights. The transfer of data is thus subject to the general constitutional principles of change in purpose and purpose. In evaluating the new use of data, however, the autonomy of the other legal order must be respected. Third countries’ state authorities are only bound by their own laws.
Limits to the transfer of data emerge on the one hand in view of the respect of data protection guarantees. The limits in the Basic Law on the domestic collection and processing of data may not be undermined in their substance by an exchange of data between security authorities. The legislature must thus ensure that the protection of fundamental rights is not eroded by the transfer of collected data by German authorities to third countries and international organisations, just as it must not be eroded by the receiving and processing of data from foreign authorities which was obtained in violation of human rights. This does not mean that, in the legal order of the third country, institutional and procedural precautions must be guaranteed in line with the German model. What is required is the guarantee of an appropriate substantive level of data protection for the handling of the transferred data in the receiving state.
On the other hand, limits to the transfer of data arise concerning the use of data by the receiving state if violations of human rights are to be feared. In any event, the transfer of data to third countries is imperatively barred if violations of the fundamental principles of the rule of law are to be feared. Under no circumstances may the state be complicit in violations of human dignity.
The transfer of data to third countries presupposes a restriction to sufficiently weighty purposes for which the data is to be transferred and used, as well as the ascertainment that the data will be handled in the third country in acceptable conformity with human rights and data protection standards. For the rest, the guarantee of effective control is also needed here.
7. In part, the challenged power to transfer data to public authorities in other countries does not fulfil these constitutional requirements.
a) It defines the purposes for a transfer too broadly (§ 14 sec. 1 BKAG). The general authorisation of a transfer of data for the fulfilment of the tasks incumbent upon the Federal Criminal Police Office (§ 14 sec. 1 sentence 1 no. 1 BKAG) is not sufficiently delimited and thus disproportionate. It lacks standards ensuring that data from surveillance measures involving particularly intrusive interferences may only be transferred for the purpose of protecting legally protected interests or investigating criminal offences of such a weight that collecting them again with comparably weighty means would, by constitutional standards, be justified. The power to transfer data for the protection against a specific, present and significant danger to public security (§ 14 sec. 1 sentence 1 no. 3 BKAG) is generally not objectionable. However, it is insufficiently limited with regard to data stemming from the surveillance of private homes. Also, insofar as a transfer of data is permitted because there are indications that criminal offences of particular seriousness will be committed (§ 14 sec. 1 sentence 2 BKAG), limiting distinctions – following the criterion of a hypothetical re-collection of data – are lacking.
b) In contrast, the challenged provisions satisfy the requirements for ascertaining that the data will be handled in accordance with data protection standards and human rights in the receiving country. When interpreted in conformity with the Constitution, § 14 sec. 7 BKAG sufficiently ensures such ascertainment.
c) With regard to domestic transfer practices, it is constitutionally necessary to ensure a regular supervisory control, as well as the ordering of reporting duties; these requirements are, however, lacking here.
8. The challenged provisions are predominantly not to be declared void, but rather unconstitutional. Given that the constitutional shortcomings do not affect the granting of the powers as such, but essentially pertain solely to the provisions’ drafting in detail, these may – subject to the conditions determined by the Court – continue to apply up to and including 30 June 2018.
Separate Opinion of Justice Eichberger:
I cannot subscribe to the decision, in several respects concerning the conclusions drawn with regard to the challenged norms, and in parts of the reasoning.
The decision indeed moves within the framework of the case-law developed by the Court particularly over the past twelve years on the permissibility of interferences with fundamental freedoms for reasons of security, which is to be guaranteed by the state. However, the principles set out by the Senate today, as in the past, almost exclusively derive from the considerations carried out in the context of the proportionality test with a view to balancing the burdens imposed by serious measures upon the fundamental rights of the parties affected, on the one hand, and the state’s duties of protection with regard to terrorist threats, on the other. Yet here, too, the prerogative of appraisal with regard to the actual assessment of the risk situation and the prognosis of its development belongs to the legislature. In light of this, the Senate should not have set up such detailed requirements. In weighing the latent threat posed by covert surveillance and investigative measures, it must be kept in mind that most of the challenged norms do not authorise a general collection of data affecting a wide range of persons. Should, in a specific case of the carrying out of investigative measures, persons be affected to whom one can attribute little or no responsibility for the grounds of the investigation, a particular sacrifice is exacted of them as a citizen’s duty for the public guarantee of security.
Not all of the procedural, transparency and control requirements prescribed to the legislature – even if many of them make sense and may be right – are actually required exactly so by the Constitution. The judgment, despite its welcome steps toward consolidation, nevertheless leads to a problematic entrenchment of the excessive constitutional requirements in this field.
I consider it to be too far-reaching to derive from the principle of proportionality the requirements that persons affected by serious surveillance measures must be given effective sanctioning mechanisms; that the control of data collection and use must be carried out in regular intervals no longer than two years; and that reporting duties vis-à-vis Parliament and the public to ensure transparency and control must be provided. It would have been sufficient to merely prescribe the level of protection to be ensured by the legislature.
Insofar as the Senate considers the authorisation to carry out certain investigative and data collection measures for the purposes of the prevention of crime to be too unspecific and disproportionate, it needlessly fails to choose the possible option of an interpretation in conformity with the Constitution. Unlike the Senate, I consider the concept chosen by the legislature, to only require a judicial decision for an extension of the majority of the surveillance measures in § 20g sec. 2 BKAG, to be constitutionally tenable. Furthermore, I cannot share the Senate’s view that § 20g BKAG is also unconstitutional for not containing any regulation for the protection of the core area of private life.
With regard to the use of data obtained by means of surveillance measures, the judgment refines and consolidates the idea of a “hypothetical re-collection” as the notional base for determining the conditions for a change in purpose. I cannot back the exception called for by this concept, whereby every further use and change in purpose with regard to data from the surveillance of private homes or remote searches must be justified by an imminent or a sufficiently specific danger, just as for the initial collection of the data. Even in the context of the surveillance of private homes, the actual massive interference with privacy takes place when the investigation accesses the protected area. A further use – even one with a change in purpose – does indeed perpetuate this interference, but, even with regard to the surveillance of private homes (and similarly with remote searches), it does not reach the level of severity of the initial interference. The further use and change in purpose of intelligence obtained from surveillance measures must thus be subject to the general rules. The Senate should have corrected its existing case-law accordingly.
Separate Opinion of Justice Schluckebier:
Insofar as the decision objects to the challenged provisions for constitutional reasons, I cannot agree to large parts of the decision and the accompanying reasoning. In my opinion, the proportionality test applied in the decision is constitutionally misguided in several respects. Furthermore, the requirements established for the specificity of individual provisions are excessive. Ultimately, by means of numerous detailed requirements of a technical legislative nature the Senate puts its own notion of regulatory framework before those of the democratically legitimised legislature; however, as far as I am concerned, the Senate goes too far in doing so. Contrary to what the Senate assumed, some of the challenged provisions could in fact have been interpreted in conformity with the Constitution.
Generally it should be borne in mind that the legislature’s regulatory approach has essentially found an appropriate and tenable balance in the complex tension between the fundamental rights of persons affected by the police measures on the one hand, and the legislature’s obligation to protect the fundamental rights of individuals and the constitutionally protected legal interests of the general public on the other hand,. The legislature thus takes into account that, in a state governed by the rule of law, individuals must be able to rely on receiving effective protection by the state and on the protection of guaranteed fundamental freedoms against the state.
The Senate objects to the lack of an explicit statutory provision protecting the core area of private life particularly with regard to special methods for the collection of data outside private homes (§ 20g Abs. 2 BKAG); in my opinion, such an express provision is not necessary. Indeed, the affected persons are “in public” when they are not inside private homes. However, in those cases, they are not situated in specially protected private areas. The protection of the core area can be ensured at the level of the actual application of the law.
Furthermore, I do not share the reasoning with regard to the requested establishment of an “independent body” that is essentially staffed with external persons who are not entrusted with security functions and is, in respect of collection and evaluation, responsible for actually carrying out and adopting decisions on measures for the surveillance of private homes and remote searches. Given its complicated nature, the Senate’s suggested solution affects the effectiveness of the measures since the evaluation of findings is often very urgent and needed as quickly as possible in the context of the prevention of criminal offences and the protection against threats. For that reason, it does not sufficiently satisfy the requirements of appropriateness with regard to the effective prevention of terrorist crimes. The possibility offered to the legislature, to grant the Federal Criminal Police Office “certain short-term initial possibilities of taking action” in exceptional cases where danger will occur unless action is taken,– a case which, in practice, will occur rather often –, clearly contrasts the judgments’ assumption according to which the data’s special need for protection requires, as a rule, the almost complete exclusion of the Federal Criminal Police Office from the responsibility of initial review.
Insofar as the Senate assumes that the powers to a further use of the data collected in the context of the protection against threats from terrorism and the transfer of such data to domestic authorities and authorities in third countries are unconstitutional in several respects, I cannot fully agree to this either. This applies in particular insofar as the Senate states that it will permit the use of lawfully collected data in further contexts only in order to protect the same or equally important legally protected interests. The judgment predicates the transfer and use of the data for other purposes on whether, even after a change in purpose, this data serves to protect legally protected interests or to uncover criminal offences of such a weight that this could, by constitutional standards, justify collecting them again with comparably weighty means (criterion of a hypothetical re-collection of data). This perspective may be justified with regard to findings that were obtained through highly intrusive, particularly significant interferences, which is the case, for example, when measures such as the surveillance of private homes and remote searches were employed. However, with regard to other interferences, which result in so-called coincidental findings, this can, in my opinion, lead to hardly tolerable results since it requires the rule-of-law order to accept the occurrence of crimes and damage to legally protected interests. On condition that such coincidental findings were obtained through a lawful and thus also constitutional interference, my view is that it is an unacceptable consequence that a state under the rule of law is forced to deliberately “look away”. This deprives the potentially concerned individuals or the legally protected interests of the necessary protection while giving priority to the protection of the data of those persons whom the measures at issue actually target, especially given that this case does not concern a scenario of a change in purpose of mass data that was collected without cause and very broadly.
As for the additional statutory provisions called for by the Senate with regard to the transfer of data to authorities in other countries, I do not share the view that these are constitutionally required. The relevant provision (§ 14 BKAG) could have been interpreted in conformity with the Constitution. The provision explicitly states that the transfer of personal data is prohibited if there are reasons to believe that the data could be used in a manner which would violate the purpose of a German law or if, in the individual case, the protection-worthy interests of the person concerned prevail. This includes the existence of an appropriate data protection standard in the receiving state. The Act also contains transfer prohibitions and grounds for denial (§ 27 BKAG). With these, it can easily be ensured that the transfer of data does not in any way promote human rights violations in other states and that a prior ascertainment of the use of the transferred data in the receiving country takes place. Also in this context, the specifications in the regulatory framework which the legislature is now forced to create will inflate the text of this Act which is already inundated, badly legible and hardly comprehensible, leading to the opposite of norm specificity. However, in its practical application, there will not be any corresponding notable increase in the protection of the persons concerned.