On April 23rd, shortly after the European Union started working on the new Europol legal framework which is deemed to align the main intelligence led policy Agency with the Lisbon Treaty and with the European Charter the German Constitutional Court (BVG) decided to impose a strict separation between the work of the police and intelligence services. As in several other cases where the BVG jurisprudence has influenced also the European legislature this ruling will be probably thouroughly analysed also in Brussels even if the BVG maintain that the issue falls under the national exclusive competence. Therefore it will be more than likely that the principles outlined in this ruling would be taken in account in the EU draft legislation on data protection when these data are collected for security purposes.
According to the BVG press release (emphasis added) “…For the Karlsruhe based court, the exchange of data between the Federal Office for the Protection of the Constitution, intelligence services, military counter-intelligence and the police amounts to — a severe infringement of the rights of those concerned, which is why it can only be allowed in exceptional cases. The judges did, however, authorise an “anti-terrorist” listing, while declaring another “secret service contact” listing unconstitutional. Initiated in 2006, the second database contains information on 18,000 potential terrorists, supplied by 38 intelligence services.
The counter-terrorism database is in its fundamental structures compatible with the Basic Law. However, it does not meet the constitutional requirements regarding specific aspects of its design.
This is what the First Senate of the Federal Constitutional Court decided in a judgment that was issued on April 23. Under certain conditions, the unconstitutional provisions can continue to be applied until new regulation has been enacted, but no later than until 31 December 2014.
The Decision is Essentially Based on the Following Considerations:
1. The complainant challenges the Act on Setting up a Standardised Central Counter-Terrorism Database of Police Authorities and Intelligence Services of the Federal Government and the Länder (Counter-Terrorism Database Act – ATDG; Gesetz zur Errichtung einer standardisierten zentralen Antiterrordatei von Polizeibehörden und
Nachrichtendiensten von Bund und Ländern, Antiterrordateigesetz).
2. The constitutional complaint provides no reasons for a preliminary ruling before the European Court of Justice. Clearly, the Counter-Terrorism Database Act and actions that are based on it do not constitute an implementation of Union law according to Art. 51 sec. 1 sentence 1 of the Charter of Fundamental Rights of the European Union.
The Counter-Terrorism Database Act pursues nationally determined objectives which can affect the functioning of the legal relationships under EU law merely indirectly. Thus, the European fundamental rights are from the outset not applicable, and the European Court of Justice is not the lawful judge according to Art. 101 sec. 1 sentence 2 of the Basic Law (Grundgesetz – GG).
The European Court of Justice’s decision in the case Åkerberg Fransson (judgment of 26 February 2013, C-617/10) does not change this conclusion. As part of a cooperative relationship, this decision must not be read in a way that would view it as an apparent ultra vires act or as if it endangered the protection and enforcement of the fundamental rights in the member states in a way that questioned the identity of the Basic Law’s constitutional order. The Senate acts on the assumption that the statements in the ECJ’s decision are based on the distinctive features of the law on value-added tax, and express no general view. The Senate’s decision on this issue was unanimous.
3. The constitutional complaint is, in part, well-founded.
a) The counter-terrorism database is, in its basic structures, compatible with the right to informational self-determination according to Art. 2 sec. 1 in connection with Art. 1 sec. 1 GG.
aa) The exchange of information which the challenged provisions create carries considerable weight. For the persons concerned, the entry into such a database can pose a considerable hardship. It adds to the severity of the infringement of rights that the database also facilitates the exchange of information between intelligence agencies and police authorities. The legal order distinguishes between the police, which generally works in the open, is structured for the fulfilment of operational duties, and guided by detailed legal provisions; and the intelligence agencies, which generally work in secret, are limited to observation and reconnaissance for political information and consultation, and can thus act within a less complex legal framework. From the fundamental right to informational self-determination, follows that a principle of separation of information (informationelles Trennungsprinzip) applies to the exchange of data between these institutions. The exchange of data for operative tasks between the intelligence agencies and the police authorities constitutes a particularly severe infringement. This is only admissible in exceptional cases and has to serve a highly important public interest. In such a case, it is not permissible to undercut the respective thresholds for the infringements of rights that apply in cases of data acquisition. However, it mitigates the severity of the infringement that the counter-terrorism database is structured as a joint database which is essentially limited to initiating the receipt of information via data that have already been collected. The transfer of data for the fulfilment of operational duties is governed by the relevant specialised legislation which again has to comply with the constitutional requirements and the principle of the separation of information. The Counter-Terrorism Database Act itself legitimises an exchange of data for the fulfilment of operational duties only in urgent and exceptional
bb) Crimes with terrorist characteristics, at which the Counter-Terrorism Database Act is aimed, are directed against the keystones of the constitutional order and the community as a whole. It is a requirement of our constitutional order not to view such attacks as acts of war or states of emergency, which would be exempt from the adherence to constitutional requirements, but to fight them as criminal acts with means that are within the rule of law. This means, on the other hand, that in the examination of proportionality, the fight
against terrorism has to be accorded considerable weight.
cc) In view of these conflicting interests, there are no constitutional objections against the fundamental structures of the counter-terrorism database. However, the provisions of the database only meet the requirements of the principle of proportionality in the narrow sense, if these norms are clear and sufficiently narrow with regard to which data are to be recorded and how these data may be used, and if qualified supervisory requirements both exist and are adhered to.
b) The Counter-Terrorism Database Act does not fully meet these requirements.
aa) § 1 sec. 2 ATDG, which merely regulates the participation of further police authorities in the counter-terrorism database according to broad criteria that are open to judgment, is incompatible with the requirement of legal certainty. If, in this setting, the legislature chooses to leave the decision about the authorities involved up to the executive, it has to do so via a legislative ordinance. A mere administrative regulation is insufficient.
bb) Not in every respect compatible with the constitutional requirements are the provisions which determine the scope of people who the database may cover.
(1) First, § 2 sentence 1 no. 1 ATDG covers members, supporters, and support groups of terrorist organisations. However, the provision enlarges this circle to persons who merely support a support group, without clarifying that a conscious support of activities which support terrorism is required. Thus persons can be covered who – prior to, and unaware of a relationship to, terrorist activities – support an organisation that seems unsuspicious to them. This violates the principle of the clarity of legal provisions and is incompatible with the prohibition of disproportionate measures. An interpretation in conformity with the Constitution is not possible in this case.
(2) § 2 sentence 1 no. 2 ATDG is also not fully compatible with the Constitution. The provision, which is meant to cover individuals who might have an affinity to terrorism, combines a number of ambiguous and potentially broad legal terms. Because of a tie in the Senate’s votes, the terms “unlawful use of violence” (“rechtswidrige Gewalt”) and “intentional incitement of such use of violence” (“vorsätzliches Hervorrufen solcher Gewalt”) cannot be declared unconstitutional. According to the four members of the Senate who carry this part of the decision, the use of these criteria is
compatible with the Basic Law as long as they are not accorded an overly wide meaning, and in particular the term “violence” is only understood as violence that is directed directly against life and limb or characterised by means that are dangerous to public safety. According to the view of the other four members of the Senate, the provision would
have to be declared unconstitutional as a whole because of its lack of specificity and an overly wide reach; an interpretation in conformity with the Constitution would not be possible.
The mere “advocating” of violence (“Befürworten von Gewalt”) within the meaning of this provision is, according to the Senate’s unanimous view, not sufficient for recording a person in the counter-terrorism database. The provision thus violates the prohibition of disproportionate measures. In this case, the law uses subjective convictions as its yardstick and thus lays out criteria which an individual can only control to a limited degree and which cannot be influenced by behaving in a perfectly legal way.
(3) § 2 sentence 1 no. 3 ATDG is unconstitutional. According to this provision, the basic data must be stored in the database if contact persons do not know about the protagonist’s connection to terrorism. If they do know about the protagonist’s connection to terrorism, the extended basic data must be stored as well. Consequently, the exchange of non-encoded information between the participating authorities also includes data concerning the contact persons. The provision is neither compatible with the principle of clarity of legal provisions nor with the prohibition of disproportionate measures. However, it is not generally prohibited by constitutional law to make data of contact persons available in the anti-terror database. As a general rule, such persons are only of interest to the degree they can provide information about the protagonist who is thought to have a close connection to terrorism. This is what the legislation must have in mind as well. It
would be possible in such a situation to store only some elementary data about contact persons and to store them, as information concerning the protagonist with a connection to terrorism, in such a way that they can only be searched covertly.
cc) The extent of the data stored, which is set out in § 3 sec. 1 nos. 1a and 1b ATDG, is constitutionally unobjectionable. However, with regard to some data, it is necessary to document and to publish the intermediate administrative steps by which they are specified. This duty of documentation and publication applies to the characteristics set out
in § 3 sec. 1 no. 1b gg, hh, ii, kk, nn ATDG (for instance concerning the storage of data about skills which are relevant in connection with terrorism), which are phrased very broadly. They meet the requirement of the clarity of legal provisions because these characteristics can only be specified by the security authorities. The legislature, however, has to ensure that the way in which this is done is documented and published. Current practice is that the vague legal terms are specified, and standardised, by a catalogue of the characteristics which are to be stored; this list is part of the computer programme. The Federal Government has provided the Senate with a “Catalogue Manual” on this.
The Counter-Terrorism Database Act, however, does not provide for a publication of this manual. Thus, the present legal situation does not satisfy the requirements of a legislation which is structured in accordance with the rule of law.
The free text field (§ 3 sec. 1 no. 1b rr ATDG) is compatible with the prohibition of disproportionate measures. This is not a blanket authorisation for adding further information at will but opens the database for notes and assessments which cannot be shown otherwise due to the standardisation and catalogisation of the entries.
dd) The provisions on the use of the data are not in every respect compatible with the prohibition of disproportionate measures.
(1) The provisions on the request and use of the basic data are constitutionally unobjectionable. The same applies to requests for extended basic data to the extent that information is requested which relates to a certain name (§ 5 sec. 1 sentences 1 and 3 in conjunction with § 3 sec. 1 no. 1b ATDG). Here, the authority does not have access to the extended basic data themselves but only receives the information that a match has been found and information on which authority stores the data in question and on the file number under which they are stored.
Direct access to the extended basic data is only made possible on request in individual cases as set out in specialised law; it requires authorisation by the authority storing the data.
(2) The provision on what is known as reverse search is not compatible with the prohibition of disproportionate measures (§ 5 sec. 1 sentence 2 no. 1a ATDG). Reverse search of the extended basic data is related to specific characteristics; in the case of a match, it provides the requesting authority not only with a source of further information but with direct access to the basic data in question. An authority can for instance search for persons with a specific religious affiliation and occupational qualification who regularly visit a certain meeting place.
If there is a match, the requesting authority not only receives information about which authority has these data, but also the names, addresses and other basic information about all persons to whom the characteristics it inquired about apply. Such a far-reaching use does not take sufficient account of the significance of the content of the extended basic data. If a search covers extended basic data, only the file number and the authority storing the information may be shown, but not the corresponding basic data.
(3) There are no concerns under constitutional law against use of the extended basic data in an emergency (§ 5 sec. 2 in conjunction with § 6 sec. 2 ATDG), not even with regard to a reverse search. The conditions under which such a use is permitted are drafted in a manner that is restrictive enough as to justify the intervention. The provision complies with the prohibition of disproportionate measures and also adheres to the principle of the separation of information between the police and the intelligence services.
ee) Due to the purpose and the functioning of the database, the Counter-Terrorism Database Act ensures transparency of the exchange of information only to a limited extent. Thus, only limited possibilities of legal protection are open to the persons affected. This is compatible with the Constitution if the conditions set out in constitutional law are adhered to when it comes to effectively organising the supervision.
The supervisory instances at federal and state level – currently, the data protection commissioners – must have effective powers. There must be complete records of any access to sets of data, and of their modification; the records must be made available to the data protection commissioners in such a way that they can be evaluated in a practicable manner. There must be checks in appropriate intervals; the duration of such intervals may not exceed a certain maximum of approximately two years.
No sufficient legal provision has been made concerning the requirement of mandatory checks in definite intervals; in this regard the legislature has a duty to amend the law. In all other respects, the provisions are to be interpreted in conformity with the Constitution.
Furthermore, the legislature has to observe whether conflicts arise which must be clarified by the law or which require mechanisms for dispute settlement, such as an extension of the right to bring an action.
ff) Finally, statutory provisions on duties to report are required to ensure transparency and supervision. It must be ensured that the Federal Criminal Police Office reports to Parliament and to the general public about the data stored in the counter-terrorism database and about the use of the database.
c) The additional complete and unrestricted incorporation, which is provided by the law, of all data collected through infringements of Art. 10 sec. 1 (secrecy of telecommunications) and of Art. 13 sec. 1 GG (inviolability of the home) into the counter-terrorism database is incompatible with the Constitution. In view of the particularly high degree of protection provided by these articles, particularly strict requirements apply, as a general rule, to data collections which infringe these fundamental rights. The additional unrestricted incorporation of such data into the counter-terrorism database makes the information available, irrespective of terrorist acts that have already been committed or are imminent, for investigation measures that take place even before tangible danger situations arise, and even though it would not be possible to justify collecting data through infringements of the secrecy of telecommunications or of the inviolability of the home for such measures. This undercuts he requirements on data collection in this field.
In contrast, a legislation which would always require covert storage pursuant to § 4 ATDG for such data would under proportionality aspects be compatible with the Constitution. Such legislation would make the corresponding information available only under the data transfer regulations in the specialised laws. The specialised laws, in turn, could ensure specific thresholds for infringement, which are required by constitutional law, and a sufficiently effective protection of legal interests.
4. The partial unconstitutionality of the challenged provisions does not result in their being declared void; it is only established that they are incompatible with the Basic Law. Until new legislation has been enacted, but, however, no later than until 31 December 2014, the provisions may continue to be applied. Before they continue to be applied, however, it must be ensured that certain conditions are adhered to.”
This press release is also available in the original german version.