[governance] Germany: New Basic Right to Privacy of Computer Systems

[Ralf Bendrath]

FYI, an important landmark ruling that created a new fundamental right 
related to computer privacy. Front page headlines all over the place in 
Germany. :-)

See below for more details if you have not read about it yet, and also 
worth a look because a lot of the english press coverage got parts of it 
wrong.

Best, Ralf

<http://bendrath.blogspot.com/2008/02/germany-new-basic-right-to-privacy-of.html>

Thursday, February 28, 2008

Germany: New Basic Right to Privacy of Computer Systems

The German Constitutional Court on 27 February 2008 published a landmark 
ruling about the constitutionality of secret online searches of computers 
by government agencies. The decision constitutes a new "basic right to the 
confidentiality and integrity of information-technological systems" as 
derived from the German Constitution.

The journalist and privacy activist Bettina Winsemann, the politician 
Fabian Brettel (Left Party), the lawyer and former federal minister for 
the interior Gerhart Baum (Liberal Party), and the lawyers Julius Reiter 
and Peter Schantz had challenged the constitutionality of a December 2006 
amendmend to the law about the domestic intelligence service of the 
federal state of North-Rhine Westphalia. The amendmend had introduced a 
right for the intelligence service to "covertly observe and otherwise 
reconnoitre the Internet, especially the covert participation in its 
communication devices and the search for these, as well as the clandestine 
access to information-technological systems among others by technical 
means" (paragraph 5, number 11). Parts of the challenges also addressed 
other amendmends which are not covered here.

The decision of today is widely considered a landmark ruling, because it 
constitutes a new "basic right to the confidentiality and integrity of 
information-technological systems" as part of the general personality 
rights in the German constitution. The reasoning goes:

     "From the relevance of the use of information-technological systems 
for the expression of personality (Persönlichkeitsentfaltung) and from the 
dangers for personality that are connected to this use follows a need for 
protection that is significant for basic rights. The individual is 
depending upon the state respecting the justifiable expectations for the 
integrity and confidentiality of such systems with a view to the 
unrestricted expression of personality." (margin number 181)

The decision complements earlier landmark privacy rulings by the 
Constitutional Court that had introduced the "right to informational 
self-determination" (1983) and the right to the "absolute protection of 
the core area of the private conduct of life" (2004).

Information-technical systems that are protected under the new basic right 
are all systems that

     "alone or in their technical interconnectedness can contain personal 
data of the affected person in a scope and multiplicity such that access 
to the system makes it possible to get insight into relevant parts of the 
conduct of life of a person or even gather a meaningful picture of the 
personality." (margin number 203)

This includes laptops, PDAs and mobile phones.

The decision also gives very strict exceptions for breaking this basic 
right. Only if there are "factual indications for a concrete danger" in a 
specific case for the life, body and freedom of persons or for the 
foundations of the state or the existence of humans, government agencies 
may use these measures after approval by a judge. They do not, however, 
need a sufficient probability that the danger will materialize in the near 
future. Online searches can therefore not be used for normal criminal 
investigations or general intelligence work.

If these rare conditions are met, secret online searches may only be used 
if there are steps taken to protect the core area of the private conduct 
of life, which includes communication and information about inner feelings 
or deep relationships. These protections have to include technical 
measures that aim at avoiding the collection of data from this core area. 
The Court goes on:

     "If there are concrete indications in the specific case that a 
certain measure for gathering data will touch the core area of the conduct 
of private life, it has to remain principally undone." (margin number 281)

If data from this core area is accidentially collected, it must be deleted 
immediately and can not be used or forwarded in any case.

Reactions to the decision were mixed. The opposition parties and many 
civil liberties groups acclaimed the birth of the new basic right with 
constitutional status and the high hurdles for any future use of 
governmental spyware. Others, among them many bloggers, were sceptical 
about the exception clauses and how far they can be stretched by the 
government in future legislation and practice.

Secret online searches of personal hard drives and other storage media had 
been subject to intense political debate in Germany over the last year 
after the federal government had to admit it had already tried online 
searches for criminal investigations without legal grounds and was stopped 
by the Federal High Court. The federal government as well as several 
states plan to enact similar possibilities for their intelligence and law 
enforcement agencies, while the opposition parties and parts of the ruling 
Social Democrats are strictly against it. Privacy activists have called 
the plan "Federal Trojan" ("Bundestrojaner"). A real-life sized model of a 
trojan horse in Germany's national colors which was built by activists 
from the Chaos Computer Club (CCC) and used at several protest marches 
will soon be exhibited in the Museum of German History in Bonn.

The "Federal Trojan" in front of the Constitutional Court during its 
hearing on the case on 10 October 2007. Picture by Leralle, licensed under 
Creative Commons BY-NC-SA 2.0 Germany.

Federal Minister for the Interior Wolfgang Schäuble (Christian Democrats) 
said he expects that the coalition will soon agree on a bill to give the 
Federal Criminal Agency (BKA) the legal possibility to use online searches 
in the fight against international terrorism. Privacy advocates pointed 
out that Schäuble now at least has to stick to a very narrow definition of 
fighting terrorist dangers and can not use this as a disguise for 
introducing general and far-reaching surveillance of personal computer 
systems.

Links:

     * Constitutional Court Press Release (in German, 27.02.2008)
     * Constitutional Court Decision (BVerfG, 1 BvR 370/07) (in German, 
27.02.2008)
     * Video from the announcing of the decision
     * Comprehensive press and background coverage (in German)
     * Deutsche Welle: Germany's Highest Court Restricts Internet 
Surveillance (27.02.2008)


This article also appeared in the "EDRI-gram" newsletter by European 
Digital Rights (EDRi), number 6.4, 27 February 2008.
____________________________________________________________
You received this message as a subscriber on the list:
     governance at lists.cpsr.org
To be removed from the list, send any message to:
     governance-unsubscribe at lists.cpsr.org

For all list information and functions, see:
     http://lists.cpsr.org/lists/info/governance