On 27 February 2008, the German Federal Constitutional Court (Bundesverfassungsgericht) annulled provisions of the North-Rhine Westphalian Act on the Protection of the Constitution, which allowed the government to conduct online surveillance of personal computers. The court ruled that the provisions were unconstitutional as they did not sufficiently respect the individual’s right to confidentiality of data stored on information technology systems and the integrity of information technology systems themselves. The new right could be termed the "IT Privacy" right.
Under the annulled provisions, certain public authorities had rather comprehensive rights to use "spyware" to:
- secretly access an individual’s information technology systems;
- search data stored on those systems; and
- monitor online communications.
The court held that the right to confidential communication as granted by Article 10 of the German Constitution (Grundgesetz) also applies to online communications such as email. In addition, the court found that accessing data on information technology systems constituted an invasion of an individual’s privacy as protected by Articles 1 and 2 of the German Constitution.
The court therefore decided that unjustified online surveillance violated the right to a "guarantee of confidentiality and integrity of information technology systems", which the court considered to be part of the fundamental right to privacy.
The legitimate grounds for justification need to be defined by the legislator. However, the court put high demands in this respect. It ruled that, to be justified, there would have to be factual evidence indicating a specific threat to an outstanding and overriding legal interest such as threats to the life or freedom of an individual or threats concerning the fundamentals or existence of the state.
Additionally, to ensure that fundamental rights are protected, any and all online surveillance can only be conducted upon a judge's prior authorisation.
Impact of the ruling
This ruling marks the entry of the German Federal Constitutional Court into the "Online Age". The court strengthened the individual's rights by expanding and adapting traditional "offline" fundamental rights to accommodate new emerging technologies and technical means.
This landmark decision has been long awaited. Although it annulled specific statutory provisions, the ruling also establishes general guidelines for a new constitutional law. The legislator must now redraft the law in accordance with the ruling.
A full transcript of the ruling is available in German on the website of the Constitutional Court (joint cases of constitutional complaints 1 BvR 370/07 and 1 BvR 595/07): http://www.bundesverfassungsgericht.de/en/decisions/rs20080227_1bvr037007.html.
Reassurance of the Right to Privacy
In two subsequent decisions in March 2008, the German Federal Constitutional Court emphasised the importance of the right to privacy and informational self-determination:
The court prohibited the automatic recording of car number plates (http://www.bundesverfassungsgericht.de/en/decisions/rs20080311_1bvr207405.html) and it has preliminarily limited the scope of purposes for which collected and retained telecommunications data can be transferred to investigating authorities (http://www.bundesverfassungsgericht.de/en/decisions/rs20080311_1bvr025608.html).