Germany: New basic right to privacy of computer systems

(Dieser Artikel ist auch in deutscher Sprache verfügbar)

The German Constitutional Court published on 27 February 2008 a landmark
ruling about the constitutionality of secret online searches of computers by
government agencies. The decision constitutes a new “basic right to the
confidentiality and integrity of information-technological systems” as
derived from the German Constitution.

The journalist and privacy activist Bettina Winsemann, the politician
Fabian Brettel (Left Party), the lawyer and former federal minister for
the interior Gerhart Baum (Liberal Party), and the lawyers Julius Reiter
and Peter Schantz had challenged the constitutionality of a December 2006
amendmend to the law about the domestic intelligence service of the
federal state of North-Rhine Westphalia. The amendmend had introduced a
right for the intelligence service to “covertly observe and otherwise
reconnoitre the Internet, especially the covert participation in its
communication devices and the search for these, as well as the clandestine
access to information-technological systems among others by technical
means” (paragraph 5, number 11). Parts of the challenges also addressed
other amendmends which are not covered here.

The decision of today is widely considered a landmark ruling, because it
constitutes a new “basic right to the confidentiality and integrity of
information-technological systems” as part of the general personality
rights in the German constitution. The reasoning goes: “From the relevance
of the use of information-technological systems for the expression of
personality (Persönlichkeitsentfaltung) and from the dangers for
personality that are connected to this use follows a need for protection
that is significant for basic rights. The individual is depending upon the
state respecting the justifiable expectations for the integrity and
confidentiality of such systems with a view to the unrestricted expression
of personality.” (margin number 181). The decision complements earlier
landmark privacy rulings by the Constitutional Court that had introduced
the “right to informational self-determination” (1983) and the right to
the “absolute protection of the core area of the private conduct of life”
(2004).

Information-technical systems that are protected under the new basic right
are all systems that “alone or in their technical interconnectedness can
contain personal data of the affected person in a scope and multiplicity
such that access to the system makes it possible to get insight into
relevant parts of the conduct of life of a person or even gather a
meaningful picture of the personality.” (margin number 203). This includes
laptops, PDAs and mobile phones.

The decision also gives very strict exceptions for breaking this basic
right. Only if there are “factual indications for a concrete danger” in a
specific case for the life, body and freedom of persons or for the
foundations of the state or the existence of humans, government agencies
may use these measures after approval by a judge. They do not, however,
need a sufficient probability that the danger will materialize in the near
future. Online searches can therefore not be used for normal criminal
investigations or general intelligence work.

If these rare conditions are met, secret online searches may only be used
if there are steps taken to protect the core area of the private conduct
of life, which includes communication and information about inner feelings
or deep relationships. These protections have to include technical
measures that aim at avoiding the collection of data from this core area.
The Court goes on: “If there are concrete indications in the specific case
that a certain measure for gathering data will touch the core area of the
conduct of private life, it has to remain principally undone.” If data
from this core area is accidentially collected, it must be deleted
immediately and can not be used or forwarded in any case.

Reactions to the decision were mixed. The opposition parties and many
civil liberties groups acclaimed the birth of the new basic right with
constitutional status and the high hurdles for any future use of
governmental spyware. Others, among them many bloggers, were sceptical
about the exeption clauses and how far they can be stretched by the
government in future legislation and practice.

Secret online searches of personal hard drives and other storage media had
been subject to intense political debate in Germany over the last year
after the federal government had to admit it had already tried online
searches for criminal investigations without legal grounds and was stopped
by the Federal High Court. The federal government as well as several
states plan to enact similar possibilities for their intelligence and law
enforcement agencies, while the opposition parties and parts of the ruling
Social Democrats are strictly against it. Privacy activists have called
the plan “Federal Trojan” (“Bundestrojaner”). A real-life sized model of a
trojan horse in Germany’s national colors which was built by activists
from EDRi member Chaos Computer Club (CCC) and used at several protest
marches will soon be exhibited in the Museum of German History in Bonn.

Federal Minister for the Interior Wolfgang Schäuble (Christian Democrats)
said he expects that the coalition will soon agree on a bill to give the
Federal Criminal Agency (BKA) the legal possibility to use online searches
in the fight against international terrorism. Privacy advocates pointed
out that Schäuble now at least has to stick to a very narrow definition of
fighting terrorist dangers and can not use this as a disguise for
introducing general and far-reaching surveillance of personal computer
systems.

Constitutional Court Press Release (only in German, 27.02.2008)
http://www.bverfg.de/pressemitteilungen/bvg08-022.html

Constitutional Court Decision (BVerfG, 1 BvR 370/07), (only in German,
27.02.2008)
http://www.bverfg.de/entscheidungen/rs20080227_1bvr037007.html

Video from the announcing the decision
http://video.google.com/videoplay?docid=8630696719785982383&hl=en

Comprehensive press and background coverage (only in German)

Neues Grundrecht auf Gewährleistung von Vertraulichkeit und Integrität von Informationssystemen

Germany’s Highest Court Restricts Internet Surveillance (27.02.2008)
http://www.dw-world.de/dw/article/0,2144,3152627,00.html

The most spied upon people in Europe (27.02.2008)
http://news.bbc.co.uk/1/hi/world/europe/7265212.stm

(Contribution by Ralf Bendrath – EDRi member Netzwerk Neue Medien)