Germany’s Federal Constitutional Court ruled Tuesday that multiple provisions of the country’s Federal Criminal Police Office Act (BKA Act) are unconstitutional because they infringe upon citizens’ privacy rights.
The Society for Civil Rights e.V. (Gesellschaft für Freiheitsrechte e.V. or “GFF”), a German donor-funded organization, challenged the act in court, asserting that the anti-terrorist surveillance and personal data retention practices of the Federal Criminal Police Office are unconstitutional under Germany’s Basic Law.
The Federal Criminal Police Office (BKA) is Germany’s central criminal investigation agency, established under the German constitution and the BKA Act. It is responsible for the coordination of police investigations between federal and state governments. For personal data sharing purposes, Germany set up the police information network as a joint data platform that serves federal and state police authorities, as well as some judicial authorities.
The constitutional court found that the BKA’s powers to retain previously collected basic personal data under sections 18(1) no. 2 and 18(2) no. 1, in conjunction with sections 13(3) and 29, of the act considerably interfere with the fundamental right to informational self-determination. Furthermore, the court ruled section 45(1) first sentence no. 4, which allows covert data collection from individuals linked to terrorism suspects, is incompatible with the constitution because the threshold for interference cannot satisfy the principle of proportionality.
However, these unconstitutional provisions will continue to apply until the legislature has enacted new provisions, though the application shall be subject to certain restrictions. According to the decision, section 45(1) first sentence no. 4 will only be applied:
If the person who is – not merely temporarily or accidentally – associated with the [contact] person affected by the measure pursuant to § 45(1) first sentence of the Act (§ 39(2) no. 2 of the Act) meets one of the requirements set out in § 45(1) first sentence nos. 2 to 3 of the Act.
As to section 18(1) no. 2 and section 18(2) no. 1, the application shall be subject to the condition that：
The retention of personal data under the provisions is only permitted if a specific unfavorable prognosis has been made that affected persons are sufficiently likely to be connected to potential crimes in a manner relevant under criminal law and if it is precisely the retained data that can make a reasonable contribution to the prevention and prosecution of such crimes.
In April 2016, Germany’s Constitutional Court decided that several provisions of the BKA Act that entitle federal police to exercise surveillance power were incompatible with the Basic Law since they are insufficient to provide individuals with rule-of-law safeguards protecting privacy or guaranteeing transparency. Against this backdrop, the latest version of the BKA Act was adopted by legislators in 2017 to carry out the requirements that resulted from the 2016 court ruling and another EU Directive. In December 2023, the court heard the GFF’s complaints against the revised BKA Act.
The court dismissed the remainder of the GFF’s constitutional complaint.
