BKA Act partly unconstitutional: incompatible with fundamental right to informational self-determination

Parts of the BKA Act are unconstitutional.
Categories:

On October 1, 2024, the First Senate of the Federal Constitutional Court (BVerfG) ruled that key provisions of the BKA Act (BKAG) on data retention and surveillance are not compatible with the fundamental right to privacy. Informational self-determination from Article 2 para. 1 in conjunction with. Article 1 (1) of the Basic Law (GG). This applies in particular to the regulations that allow the Federal Criminal Police Office (BKA) to store data in the police information network.

BKA law: surveillance and storage powers under scrutiny

The complainants, who include lawyers, a political activist and members of the organized soccer fan scene, have objected to various surveillance and storage powers of the BKA, in particular:

  • The secret surveillance of contact persons for counter-terrorism purposes (Section 45 (1) sentence 1 no. 4 BKAG),
  • the storage of data in the police information network (Section 18 (1) No. 2, (2) No. 1 BKAG) and
  • the further processing of personal data in the BKA's information system (Section 16 (1) in conjunction with Section 12 (1) sentence 1 BKAG).


The police information network is a platform for the federal exchange of data between the federal and state police authorities.

Points of criticism of the BKA Act by the Federal Constitutional Court

The court found (1 BvR 1160/19) that some of the challenged provisions interfered with the complainants' fundamental right to Informational self-determination intervene. These interventions require a legal basis that meets the constitutional requirements of proportionality.

Section 45 (1) sentence 1 no. 4 BKAG regulates special data collection powers of the Federal Criminal Police Office to avert the threat of international terrorism. The regulation authorizes the BKA to monitor persons who are not direct suspects, but who have a close relationship with suspects. The court criticized the fact that the intervention threshold was too low and did not meet the requirements of proportionality. The surveillance of contact persons requires sufficient individual proximity to the actual danger, which was not sufficiently given here.

In its judgment, the Federal Constitutional CourtThese requirements apply both to the legal interest to be protected by the data collection and to the so-called interference threshold, i.e. the reason for the surveillance. The use of an intrusive, secret surveillance power such as the one at hand presupposes at least a concrete danger to a sufficiently important legal interest in relation to the person responsible. If contact persons from the environment of the person responsible are also to be monitored by such means, there must also be a specific individual proximity of the persons concerned to the danger to be clarified. Irrespective of this, a prerequisite for the surveillance of contact persons is that surveillance of the person responsible using appropriate means would in any case be permissible. Otherwise, there would already be a lack of sufficient danger to be investigated."

Storage of data in the police information network

The court also criticizes the fact that § 18 para. 1 no. 2 in conjunction with § 13 para. 3. § 13 para. 3, § 29 BKAG lacks a clear storage threshold and an appropriate regulation on the storage period. The storage of personal data must be justified by specific factual indications, which is not sufficiently standardized in the current law. In addition, a mature concept for the storage period is missing, so that the Deletion of data is not sufficiently guaranteed.

With regard to the insufficiently differentiated regulatory concept for the storage period, the Federal Constitutional CourtAccording to § 75 para. 2 BDSG personal data deleted immediately if their Processing is inadmissible, they must be deleted to fulfill a legal obligation or their knowledge is no longer required for the fulfillment of the task. In addition, Section 75 (4) BDSG contains the obligation to provide for appropriate time limits and to ensure that these time limits are observed by means of procedural precautions. Whether stored personal data The Federal Criminal Police Office checks whether data must be deleted first and foremost as part of individual case processing that is not sufficiently guided by law or regulation. Section 77(1) sentence 1 BKAG does provide for time limits for the review of deletion obligations. However, this alone does not meet the requirements for a regulatory concept to be designed by the legislator."

Reading tip: ECJ ruling on GDPR fines - what discretion does a data protection authority have?

Further processing of data

In § 16 para. 1 i.V.m. § Section 12 (1) sentence 1 BKAG, however, the court does not see any Infringement against the Basic Law. The further processing of personal data within the scope of the original purposes (such as counter-terrorism) and the existing deletion requirements satisfied the constitutional requirements.

Consequences of the judgment

The ruling has far-reaching consequences for the legal basis of the BKA's surveillance and storage powers:

The provisions in question will remain in force until July 31, 2025, albeit with certain conditions. For example, personal data may only be stored if there is a sufficient probability that the data subjects will be identified in connection with possible Criminal offenses and the data can make a significant contribution to prevention or prosecution. Surveillance of contact persons is also restricted so that it may only be used if there is a clear risk.

The legislator is now required to amend the BKAG in line with the constitution by 2025 at the latest. This concerns in particular the clear definition of storage and intervention thresholds as well as the determination of an appropriate storage period.

The ruling makes it clear that counter-terrorism measures must always be in line with the fundamental right to Informational self-determination must stand. In particular, secret surveillance measures and the storage of personal data are subject to strict requirements.

Source: Judgment of the Federal Constitutional Court of October 01, 2024 (1 BvR 1160/19)

Tags:
Share this post :