Order of 17 July 2024 - 1 BvR 2133/22
In an order published today, the First Senate of the Federal Constitutional Court found certain powers relating to data collection and transfer conferred on the Hessian Land Office for the Protection of the Constitution (Landesamt für Verfassungsschutz, hereinafter: Land Office) by the Hessian Protection of the Constitution Act (Hessischen Verfassungsschutzgesetz – HVSG, hereinafter: the Act) to be incompatible with the Basic Law (Grundgesetz – GG) because they violate the general right of personality (Art. 2(1) in conjunction with Art. 1(1) of the Basic Law) in its manifestation as the right to informational self-determination:
§ 9(1) no. 2 of the Act (tracking of mobile devices) is unconstitutional as it permits continuous monitoring of the movements of the persons concerned on a long-term basis without providing for a sufficient threshold for interference.
§ 10(2) first sentence no. 1 and second sentence of the Act (special requests for information from private transport operators and airlines) is unconstitutional because this power results in an interference of increased severity, but does not provide for a sufficient threshold for interference.
§ 12(1) first sentence of the Act (use of undercover officers) is unconstitutional because it allows for intrusive operations by undercover officers, but does not provide for a sufficient threshold for such interference.
In addition, to the extent that § 9(1) no. 2, § 9(2) and § 12(1) first and second sentence of the Act refer to § 3(2) second sentence of the Act, they are also unconstitutional.
§ 20a first sentence of the Act (data sharing with prosecution authorities) is unconstitutional insofar as the criminal offences with which § 20a second sentence letter b and third sentence of the Act are linked are not sufficiently serious criminal offences.
§ 20b(2) of the Act (data sharing with other domestic authorities) is unconstitutional because the provision also authorises data sharing with domestic authorities with operational follow-up powers without a sufficient threshold for such data sharing.
§ 20a first sentence of the Act, to the extent it refers to § 20a third sentence of the Act, is void. The remaining provisions of the Act will continue to apply subject to certain conditions.
Facts of the case:
Two of the complainants are members of and actively involved in running an organisation classified as an extremist organisation by the Land Office. Two other complainants are lawyers who represent clients that are under surveillance by the Land Office due to accusations that they belong to or support foreign terrorist organisations or belong to far-left extremist groups. Another complainant is a freelance journalist who has frequent contact with persons who are under surveillance by the Land Office. They challenge various data collection and data sharing powers set out in the Act, which were in large part revised in 2023 following the judgment of the Federal Constitutional Court of 26 April 2022 on the Bavarian Protection of the Constitution Act.
Key considerations of the Senate:
I. Insofar as the constitutional complaint is admissible, it is for the most part well-founded. The challenged provisions only partially satisfy the requirements for the constitutional justification of interferences in the right to informational self-determination.
1. Pursuant to § 9(1) no. 2 of the Act, the Land Office is authorised in individual cases to use technological means to track the location of a mobile device in active communications mode, so long as such measure is necessary for the performance of its tasks. This authorisation permits a severe interference in fundamental rights, which is not justified.
a) The location tracking pursuant to § 9(1) no. 2 of the Act is a severe interference because it permits near-synchronous geographical tracking over a prolonged period and thereby the creation of movement profiles.
b) aa) § 9(1) no. 2 of the Act does not contain a sufficiently high threshold for interference that would correspond to its severity. The severity of the interference with fundamental rights of a particular measure must be balanced against the need for surveillance of the (purported) endeavour. The greater the severity of the interference, the more urgent the need for surveillance of the observed activity or group must be. Given that mobile telephone location tracking may constitute a severe interference with fundamental rights, it requires a correspondingly higher need for surveillance. § 9(1) no. 2 of the Act does not provide for this prerequisite.
bb) § 9(2) of the Act also does not include a sufficiently high threshold for interference for measures pursuant to § 9(1) no. 2 of the Act. It is true that in cases subject to § 9(2) of the Act, technological means may only be used pursuant to § 9(1) no. 2 of the Act insofar as needed for the investigation of endeavours or activities in the individual case that have a high need for surveillance in accordance with § 3(2) of the Act. However, § 9(2) of the Act does not extend to all cases of location detection that involve a high level of interference, as this rule only applies when technological means are used to track the movements of a mobile telephone using location data (movement profile). Any location detection not conducted to create a movement profile is therefore a priori not subject to the threshold in § 9(2) of the Act, even though such actions may also involve severe interferences with fundamental rights. In addition, to the extent that § 9(2) of the Act cumulatively requires the measures to take place multiple times within a day for three consecutive days, this does not cover all conceivable cases that involve a severe interference with fundamental rights. This includes, for example, cases in which location detections occur intermittently or even near-synchronously for periods of three consecutive days, interrupted by a single day without location tracking, for a prolonged period.
cc) Further, § 9(1) no. 2 and § 9(2) in conjunction with § 3(2) second sentence of the Act also do not satisfy the constitutional requirements for a sufficient threshold for interference on their own. As location detection for the purpose of creating a movement profile which is carried out multiple times daily for more than three days constitutes a severe interference in fundamental rights, it must be essential for the surveillance of specific endeavours or activities that have a heightened need for surveillance in each individual case. The need for surveillance becomes more urgent as the factual indications make it appear increasingly possible that the elements of the constitutional order protected by the Act are at specific risk and that actions directed against them may succeed (‘potentiality’).
To the extent that § 9(1) no. 2 and § 9(2) of the Act incorporate § 3(2) second sentence of the Act by reference, they do not meet this standard. The specification of a high need for surveillance in § 3(2) second sentence of the Act does not guarantee that the urgency of the need for surveillance corresponds to the actual intensity of the threat to the elements of the constitutional order protected by the Act. This is because the endeavours described in § 3(2) second sentence nos. 1 through 4 of the Act are automatically classified by the law as having a high need for surveillance within the meaning of § 3(2) first sentence, without the need for any further test as to their potentiality in the individual case.
In contrast, the endeavour described in § 3(2) second sentence no. 1 letter c of the Act is sufficient in and of itself to meet constitutional requirements. According to this provision, endeavours which result in or are aimed at the commission of other criminal offences in order to reach their respective aims are in high need of surveillance within the meaning of § 3(2) first sentence of the Act. This suffices as an indication of a sufficient degree of potentiality.
Conversely, to the extent that § 3(2) second sentence no. 4 of the Act requires that the endeavour seek to exert considerable influence on society, this does not meet constitutional requirements. This criterion is not suitable to serve as an indication of a sufficient degree of potentiality.
dd) Due to the potentially considerable severity of an interference entailed by the location detection of a mobile phone authorised under § 9(2) no. 2 of the Act, independent ex ante oversight is required. The Act does not provide for such oversight.
§ 10(2) first sentence no. 1 of the Act authorises the Land Office in individual cases, when necessary for the performance of its tasks, to request information from private transport operators as well as operators of computerised reservation systems and global distribution systems for air travel, including information on the names and addresses of passengers as well as information on the date and the circumstances of travel, if there are factual indications of endeavours and activities pursuant to § 2(2) of the Act. The provision allows for interferences of a higher severity with fundamental rights. The resulting stricter requirements in regard to the need for surveillance of the purported endeavour or activity are not met by this provision, even when taking into consideration § 10(2) second sentence of the Act.
a) § 10(2) second sentence of the Act authorises interferences of a higher, if not serious, severity with the fundamental right to informational self-determination. This provision extends to the retrieval of the names and addresses of the affected persons as well as the dates and circumstances of travel, specifically, the time of check-in, departure and the manner of booking, including the method of payment. This notwithstanding, the requested data only provide a truncated and, in terms of time, very limited glimpse into the life of the person affected. The amount of data requested and the duration for which such information is requested nonetheless increase the severity of the interference. Any travel information still saved at the time of the request as well as any information on future travel itineraries within the period specified in the request or even information on booked travel can be requested. The provision does not evidently provide for any temporal limitation to such requests.
b) In light of the heightened level of interference, a correspondingly higher need for surveillance of the purported endeavour or activity is necessary, for which the legislator must provide sufficiently specific criteria. This is not satisfied by § 10(2) first sentence no. 1 of the Act, even when taking into consideration § 10(2) second sentence of the Act.
To the extent that a request for information involves a case in which factual indications for an endeavour under § 2(2) no. 1 of the Act are present, § 10(2) second sentence of the Act does impose a higher threshold for interference, in that the endeavour must be directed at inciting, or, due to the manner in which it is effected, be sufficient to incite hatred or hostility against portions of the population or to induce violence or preparation for violence. However, § 10(2) second sentence of the Act does not provide factual indications or indices of a heightened potentiality, but instead leaves no leeway to the Land Office to come to a different conclusion in individual cases, such as, for example, of particularly amateurish operations. It is therefore not ensured that sufficient factual indications be present that make it appear increasingly possible that the elements of the constitutional order protected by the Act are at specific risk and that actions directed against them may succeed.
The same applies in overall outcome for § 10(2) first sentence no. 1 of the Act, insofar as the request for information concerns a case in which factual indications for an endeavour or activity within the meaning of § 2(2) nos. 2 through 5 exist. The legislator evidently assumes that the endeavours and activities described in § 2(2) nos. 2 through 5 automatically entail a heightened need for surveillance. As with the provisions described above, however, the legislator has not ensured that sufficient factual indications be present that make it appear increasingly possible that the elements of the constitutional order protected by the Act are at specific risk and that actions directed against them may succeed.
3. Pursuant to § 12(1) first sentence of the Act, the Land Office may deploy its own officers under a cover given to them on a permanent basis (undercover officers) when this is necessary for the surveillance of a specific endeavour or activity that is in need of surveillance by an intelligence service. This power allows for severe interferences with fundamental rights and does not satisfy the corresponding requirements for justification under constitutional law.
a) Measures under § 12(1) first sentence of the Act can interfere with the fundamental right to informational self-determination if undercover officers gain access to personal data during the course of their undercover activities. It can involve cultivating and then exploiting what appears to be a genuine relationship of trust. In cases where the state exploits personal trust in order to overcome the affected person’s interest in maintaining secrecy, thereby inducing them to disclose information, the resulting interference can be extremely severe. The severity of the interference will differ significantly depending on the specific circumstances of the undercover deployment. It depends in particular on the duration of the undercover deployment in question. It also matters how intense the (later exploited) relationships become.
b) Due to the potentially considerable severity of the interference involved, a correspondingly high threshold for interference is required. The longer the undercover deployment lasts and the deeper the relationships of trust become and the more private information that is obtained, the more urgently the measure must necessitate surveillance and the more valuable the intelligence that the measure promises to yield must be. This prerequisite is not met by § 12(1) first sentence of the Act, as it does not impose requirements of need for surveillance or for the value of intelligence which correspond to the intensity of the interference.
It is true that for cases in which the undercover deployment lasts for more than six months, § 12(1) second sentence of the Act additionally requires that they be essential in the specific case to investigate an endeavour or activity in high need of surveillance pursuant to § 3(2) of the Act. § 12(1) second sentence of the Act thus imposes more stringent requirements in terms of how urgently surveillance is needed and how valuable the intelligence must be. The duration is also a decisive circumstance that generally increases the severity of the interference involved with using undercover officers. However, other cases of undercover deployment may also lead to severe interferences with fundamental rights. In particular, the use of undercover officers with regard to a specific person or to otherwise gather intelligence that is in any way personal and geared towards establishing a relationship of trust with those under surveillance generally amounts to a more severe interference even if the undercover deployment lasts less than six months.
Insofar as the threshold for interference in § 12(1) of the Act for the use of undercover officers for more than six months makes reference to the endeavours and activities with a high need for surveillance in § 3(2) second sentence and § 3(2) second sentence no. 4 of the Act, it – like § 9(1) no. 2 and § 9(2) of the Act – does not satisfy the constitutional requirements on its own.
4. § 20a first sentence of the Act authorises the Land Office to share data originally collected by covert means with prosecution authorities when particular facts justify the suspicion that a person has committed an especially serious crime, to the extent that such data is necessary for the prosecution of such crime. The challenged data sharing authorisation does not satisfy the requirements for constitutional justification, insofar as it also authorises data sharing for the prosecution of an especially serious crime within the meaning of § 20a second sentence letter b and third sentence of the Act.
a) Data originally collected by a domestic intelligence service may only be shared for the purpose of protecting an exceptionally significant public interest, and thus only for the purpose of prosecuting a particularly serious criminal offence. The threshold for the sharing of such data must be a suspicion based on specific and, to a certain extent, substantiated circumstances.
b) Based on this standard, the constitutional requirements for data sharing are satisfied insofar as § 20a first sentence of the Act requires that particular facts justify the suspicion that a particularly serious criminal offence has been committed. However, the sharing of personal data originally collected by covert means must also result in the prosecution of a particularly serious criminal offence, which requires a corresponding severity of the criminal offence involved. § 20a first sentence of the Act does not satisfy these requirements insofar as it also permits data sharing for the prosecution of offences defined as particularly serious criminal offences in § 20a second sentence letter b and third sentence of the Act.
aa) In determining which criminal offences qualify as particularly serious, the legislator may either refer to an existing catalogue of offences or draw up its own catalogue. In doing so, the elements that render a criminal offence serious or particularly serious must be objectively reflected in the definition of the offence in the underlying criminal law provision, in particular by the specified sentencing range and, where applicable, the description of the circumstances or consequences of the offence in the statutory offence or its qualifying offence. Based on the sentencing range, criminal offences occasioning a maximum penalty of more than five years’ imprisonment will generally be classified as particularly serious. An offence with a potential maximum penalty of at least five years’ imprisonment may also be classified as especially serious if a consideration of not only the legal interest to be protected and its significance for the legal community, but also the circumstances of the commission and consequences of the offence appear to justify such a classification.
bb) Based on this standard, the specification of what constitutes a particularly serious offence in § 20a second sentence letter a of the Act does not raise any constitutional concerns. Criminal offences with a maximum penalty of at least 10 years’ imprisonment have the requisite severity.
Insofar as § 20a first sentence of the Act also permits data sharing for the prosecution of offences defined in § 20a second sentence letter b of the Act, it does not satisfy the constitutional requirements. This provision only requires that the criminal offence have a maximum penalty of at least five years’ imprisonment. It is true that the provision also requires that the offence be linked to participation in an endeavour in need of surveillance within the meaning of § 2(2) nos. 1, 3, 4 or 5 of the Act or carrying out an activity in need of surveillance within the meaning of § 2(2) no. 2 of the Act. To this extent, the provision is also linked with a legal interest of particular significance. However, the sole fact that an offence must be directed against a legal interest protected by the Constitution is not sufficient to substantiate the particular seriousness of the offence to be prosecuted in the required overall assessment.
Likewise, § 20a third sentence of the Act also does not describe any offences with the seriousness required by the constitutional standard. The provision extends to relatively minor offences with maximum penalties of three years’ or even only one year of imprisonment.
5. In order to protect the legal interests enumerated in § 20 of the Act, § 20b of the Act authorises the Land Office to share data with other domestic authorities if sufficient factual indications are present that such data sharing is necessary for the performance of the recipient’s specific task. This provision lacks a sufficient threshold for data sharing that would satisfy constitutional requirements. As the authorisation in § 20b(2) of the Act permits data sharing with authorities that have operational follow-up powers, stringent requirements for its constitutional justification apply; at a minimum, there must be an identifiable danger. § 20b(2) of the Act does not provide for this.
II. § 20a first sentence of the Act is void to the extent that it refers to § 20a third sentence of the Act. The rest of the provisions at issue are incompatible with the Basic Law; they will continue to apply until 31 December 2025 at the latest. However, in ordering the continued applicability of the provisions, it is necessary to impose certain restrictions to protect the affected fundamental rights. To the extent that the case in question does not fall under § 9(2) of the Act, technological means pursuant to § 9(1) no. 2 of the Act may only be used such that the movements of a mobile device of a person under surveillance are tracked only intermittently and not on a long-term basis. Measures pursuant to § 9(1) no. 2, § 9(2) nos. 1 and 2, or § 12(1) first and second sentence of the Act are only permitted if § 3(2) second sentence nos. 1 through 4 of the Act are understood to be authorised examples of endeavours or activities within the meaning of § 3(2) first sentence of the Act. For special requests for information pursuant to § 10(2) first sentence no. 1 in conjunction with § 2(2) nos. 2 through 5 of the Act as well as pursuant to § 10(2) first sentence no. 1, second sentence nos. 1 and 2 of the Act, there must be factual indications that make it appear possible that the protected elements of the constitutional order are at specific risk and that actions directed against them may succeed. The sharing of personal data originally collected by covert means to domestic authorities with operational follow-up powers pursuant to § 20b(2) of the Act is only permitted if there is at least an identifiable danger.