Privacy & Cybersecurity Law Blog

On March 2, 2010, the German Federal Constitutional Court ruled that the mass storage of telephone and Internet data for law enforcement purposes is unlawful in its current form.

Since 2008, the challenged law has required telecom companies to retain data from telephone, email and Internet traffic, as well as mobile phone location data, for six months.  This information may be retrieved for law enforcement and safety purposes.  Constitutional claims were brought before the Court by nearly 35,000 citizens, representing the largest mass claim proceeding in German history. 

Highlights from the Court’s decision are detailed below. 

• According to the Court, the data retention in question is incompatible with the constitutional right of telecommunications secrecy and thus violates the German Constitution.  The data that has already been collected must be deleted without undue delay.
• The ruling does not, however, exclude the storage of the data in general.  The Court did not question the admissibility of the European Directive on Data Retention, which was the basis for the German law.
• The judges stated in their ruling that (i) the provisions of the law implementing the European Directive on Data Retention fail to observe the principle of proportionality, (ii) there is a lack of security for the data, and (iii) there is a lack of information regarding the purposes for which the data will be used.  The Court also criticized the law’s lack of transparency.
• The Court stressed that the mass storage of data is considered a very serious encroachment on fundamental rights with an impact never before seen by the German legal system.  For example, the traffic data collected would enable the creation of personality profiles and allow for the tracking of individuals’ movements.  Such a threat to fundamental rights must be subject to very strict conditions that are not met by the current German law.  The law’s provisions cannot be applied even in a limited or temporary way, and must be annulled.  Because there is then no legal basis for the storage, data retention must cease and the previously collected data must be deleted.
• The Court requested that the legislature develop strict criteria for data security that can be implemented by telecom companies, with the costs to be borne by the telecom companies since they profit from the telecommunication.
• The Court stated that the federal government needs to (i) clarify that the data retained may be used only for law enforcement purposes, (ii) establish a catalogue of crimes serious enough to merit this kind of invasive data retention, and (iii) provide clear instructions to the federal states regarding the extent to which the police may access the data to prevent danger.  Because of the perception by individuals of a constant threat of being tracked, the Court stated that the legislature must establish effective transparency rules.  Affected individuals must be informed about the data analysis, and sanctions must be imposed for violations of this obligation to inform.
• According to the Court, when a request is made to an ISP to disclose the identity of an individual using a specific IP Address, the indirect use of data collected pursuant such a request is subject to less stringent constitutional requirements.  In these cases, the authorities are not provided with the data as it is preserved by the ISP, rather they receive just the personal information related to the holder of IP address as identified by the ISP using the data.  Systematic, long-term fishing expeditions or individual profiling cannot be carried out through these kinds of disclosure requests.  Further, for such disclosure requests only a pre-determined, limited amount of data is used and storage of such data implies much less risk of encroachment on fundamental rights.  Accordingly, such disclosure requests may be ordered under less stringent conditions.