On October 1, 2024, the First Senate of the Federal Constitutional Court (BVerfG) ruled that key provisions of the BKA Act (BKAG) on data storage and surveillance are not compatible with the fundamental right to informational self-determination under Article 2 para. 1 in conjunction with Article 1 para. 1 of the German Basic Law (GG). Article 1 (1) of the Basic Law (GG). This applies in particular to the regulations that allow the Federal Criminal Police Office (BKA) to store data in the police information network.
BKA law: surveillance and storage powers under scrutiny
The complainants, who include lawyers, a political activist and members of the organized soccer fan scene, have objected to various surveillance and storage powers of the BKA, in particular:
- The secret surveillance of contact persons for counter-terrorism purposes (Section 45 (1) sentence 1 no. 4 BKAG),
- the storage of data in the police information network (Section 18 (1) No. 2, (2) No. 1 BKAG) and
- the further processing of personal data in the BKA's information system (Section 16 (1) in conjunction with Section 12 (1) sentence 1 BKAG).
The police information network is a platform for the federal exchange of data between the federal and state police authorities.
Points of criticism of the BKA Act by the Federal Constitutional Court
The court states (1 BvR 1160/19) that some of the challenged regulations interfere with the complainants' fundamental right to informational self-determination. These interferences require a legal basis that meets the constitutional requirements of proportionality.
45 para. 1 sentence 1 no. 4 BKAG regulates special data collection powers of the Federal Criminal Police Office to avert the threat of international terrorism. The regulation authorizes the BKA to monitor persons who are not direct suspects, but who have a close relationship with suspects. The court criticized the fact that the intervention threshold was too low and did not meet the requirements of proportionality. The surveillance of contact persons requires sufficient individual proximity to the actual danger, which was not sufficiently given here.
In its ruling, the Federal Constitutional Court explains: "These requirements are directed both at the legal interest to be protected by the data collection and at the so-called interference threshold, i.e. the reason for the surveillance, which is the only issue in this case. The use of an intrusive, secret surveillance power such as the one at hand requires at least a concrete threat to a sufficiently important legal interest in relation to the person responsible. If contact persons from the environment of the person responsible are also to be monitored by such means, there must also be a specific individual proximity of the persons concerned to the danger to be clarified. Irrespective of this, a prerequisite for the surveillance of contact persons is that surveillance of the person responsible using appropriate means would in any case be permissible. Otherwise, there would already be a lack of sufficient danger to be investigated."
Storage of data in the police information network
The court also criticizes the fact that § 18 para. 1 no. 2 in conjunction with § 13 para. 3. § 13 para. 3, § 29 BKAG lacks a clear storage threshold and an appropriate regulation on the storage period. The storage of personal data must be justified by specific factual indications, which is not sufficiently standardized in the current law. In addition, there is a lack of a mature concept for the storage period, so that the deletion of data is not sufficiently guaranteed.
Regarding the insufficiently differentiated regulatory concept for the storage period, the Federal Constitutional Court explains: "According to Section 75 (2) BDSG, personal data must be deleted immediately if their processing is unlawful, they must be deleted to fulfill a legal obligation or their knowledge is no longer required for the fulfillment of the task. In addition, Section 75 (4) BDSG contains the obligation to provide for appropriate time limits and to ensure that these time limits are complied with by means of procedural precautions. The Federal Criminal Police Office checks whether stored personal data is to be deleted first and foremost as part of individual case processing that is not sufficiently guided by law or regulation. It is true that Section 77 (1) sentence 1 BKAG provides for time limits for the review of deletion obligations. However, this alone does not meet the requirements for a regulatory concept to be designed by the legislator."
Reading tip: ECJ ruling on GDPR fines - what discretion does a data protection authority have?
Further processing of data
In § 16 para. 1 i.V.m. § Section 12 (1) sentence 1 BKAG, however, the court does not see a violation of the Basic Law. The further processing of personal data within the scope of the original purposes (such as counter-terrorism) and the existing deletion requirements satisfied the constitutional requirements.
Consequences of the judgment
The ruling has far-reaching consequences for the legal basis of the BKA's surveillance and storage powers:
The provisions in question will remain in force until July 31, 2025, albeit with certain conditions. For example, personal data may only be stored if there is sufficient probability that the persons concerned are connected to possible criminal offenses and the data can make a significant contribution to prevention or prosecution. The monitoring of contact persons is also restricted so that it may only be used if there is a clear risk.
The legislator is now required to amend the BKAG in line with the constitution by 2025 at the latest. This concerns in particular the clear definition of storage and intervention thresholds as well as the determination of an appropriate storage period.
The ruling makes it clear that counter-terrorism measures must always be in line with the fundamental right to informational self-determination. In particular, secret surveillance measures and the storage of personal data are subject to strict requirements.
Source: Judgment of the Federal Constitutional Court of October 01, 2024 (1 BvR 1160/19)
English 
German 
Italian 
French