Hostname: page-component-78c5997874-g7gxr Total loading time: 0 Render date: 2024-11-08T04:24:31.919Z Has data issue: false hasContentIssue false
  • English
  • Français

Pitting Karlsruhe Against Luxembourg? German Data Protection and the Contested Implementation of the EU Data Retention Directive

Published online by Cambridge University Press:  06 March 2019

Christian DeSimone

Extract

Core share and HTML view are not available for this content. However, as you have access to this content, a full PDF is available via the ‘Save PDF’ action button.

Since the 1980s Germany has developed a subtle and complex data protection jurisprudence originally designed to protect individual data subjects from rights abuses by market actors. However, the rights aggressor has increasingly been German and European law enforcement authorities. This evolving corpus of law also exhibits a singularly-German mindfulness of the historical significance of abrogating fundamental rights within constitutional democracy.

Type
Articles
Information
German Law Journal , Volume 11 , Issue 3 , 01 March 2010 , pp. 291 - 317
Copyright
Copyright © 2010 by German Law Journal GbR 

References

1 Francesca Bignami, Protecting Privacy Against the Police in the European Union: The Data Retention Directive, 8 Chicago Journal of International Law 233, 234 (2007).Google Scholar

2 Hereinafter also referred to as “the Directive,” but not to be confused with the EU Data Protection Directive of 1995.Google Scholar

3 Data Retention Case, BVerfG, 1 BvR 256/08, from 2 March 2010, available at http://www.bverfg.de/entscheidungen/rs20100302_1bvr025608.html.Google Scholar

4 Population Census Case, BVerfGE 65, 1 (para. 42).Google Scholar

5 Christian Democratic Union (national German political party) in political alliance with the Christian Social Union of Bavaria (regional political party).Google Scholar

6 Gerrit Hornung & Christoph Schnabel, Data Protection in Germany I: The Population Census Decision and the Right to Informational Self-Determination, 25 Computer Law & Security Review 84, 85(2009).Google Scholar

7 Id. at 85.Google Scholar

8 Population Census Case, supra note 4, at para. 43.Google Scholar

9 See Grundgesetz, fur die Bundesrepublik Deutschland (GG-Basic Law) May 23, 1949, Bundesgesetzblatt (BGBI) 1, art. 1, para. 1 (hereinafter Basic Law) (“The dignity of man is inviolable. To observe and protect it is the duty of all state power.”).Google Scholar

10 See id. at art. 2, para. 2 (“Each person has a right to the free development of their personality to the extent they do not injure the rights of others, contradict the constitutional order or moral law.”).Google Scholar

11 Christoph Degenhart, Das allgemeine Persönlichkeitsrecht, Art. 2 I in Verbindung mit Art. 1 I GG., 32 Juristische Schulung 1, § 361–68 (1992).Google Scholar

12 See Hornung & Schnabel, supra note 6 at 85.Google Scholar

13 Paul Tiedemann, Menschenwürde als Rechtsbegriff 391 (2007).Google Scholar

14 Population Census Case, supra note 4, at para. 43.Google Scholar

15 Id. at para. 44.Google Scholar

16 In February 2008, the BVerfG issued the second most significant ruling in the history of German data protection jurisprudence. The Online-Durchsuchungsurteil (Online Searching Case) created a new basic right to the confidentiality and integrity of information technology systems in response to Nordrhein-Westfalen's enabling the Bundesamt für Verfassungsschutz (State Office for the Protection of the Constitution) to secretly remotely search computer hard drives and private networks using Trojan Horses and other hacking tools.Google Scholar

17 See Bignami, supra note 1, at 12.Google Scholar

18 Gerrit Hornung & Christoph Schnabel, Data protection in Germany II: Recent Decisions on Online-Searching of Computers, Automatic Number Plate Recognition and Data Retention, 25 Computer Law & Security Review 115, 119 (2009).Google Scholar

19 Patrick Breyer, Telecommunications Data Retention and Human Rights: The Compatibility of Blanket Traffic Data Retention with the ECHR, 11 European Law Journal 365, 369 (2005).Google Scholar

20 Population Census Case, supra note 4, at para. 46.Google Scholar

21 In German data protection jurisprudence there is also a principle of data minimization whereby no more data than necessary is to achieve the goals associated with a given purpose are processed. This is thought to be derived directly from the principles of proportionality and purpose-specification.Google Scholar

22 Population Census Case, supra note 4, at para. 45.Google Scholar

23 Hornung & Schnabel, supra note 6, at 87.Google Scholar

24 Bignami, supra note 1, at 2.Google Scholar

25 Directive (EC) No. 95/9 of Oct. 24, 1995, 1995 O.J. (L 281/31).Google Scholar

26 Id. at art. 13.Google Scholar

27 BVerfGE 113, 348 (para. 8).Google Scholar

28 Id. at para. 9.Google Scholar

29 Id. at para. 49.Google Scholar

30 Id. at paras. 12–14.Google Scholar

31 Id. at para. 148.Google Scholar

32 Gefahrenabwehr has been a legally recognized police responsibility in the state of Niedersachsen since 1994.Google Scholar

33 Press Release, German Federal Constitutional Court, no. 68/2005, § 1(b) (Jul. 27, 2005), available at <http://www.bundesverfassungsgericht.de/en/press/bvg05-068.html>..>Google Scholar

34 Id. at § 2(b).Google Scholar

35 Id. at § 2(c).Google Scholar

36 Bignami, supra note 1, at 8.Google Scholar

37 Judith Rauhofer, Just Because You're Paranoid, Doesn't Mean They're Not After You: Legislative Developments in Relation to the Mandatory Retention of Communications Data in the European Union, 3 SCRIPTed 322, 333 (2006).Google Scholar

38 Id. at 334.Google Scholar

39 Minutes of the 124th Session of the German Federal Parliament, 9 November 2007, page 12995, available at http://www.bundestag.de/dokumente/protokolle/amtlicheprotokolle/2007/ap16124.html (emphasis added).Google Scholar

40 Convention for the Protection of Individuals with regard to Automatic Processing of Personal Data, Jan. 28, 1981, E.T.S. 108.Google Scholar

41 Bignami, supra note 1, at 15.Google Scholar

42 See Convention for the Protection of Human Rights and Fundamental Freedoms, Nov. 4, 1950, 5 E.T.S. 8 (specifying that the right to a private life should not be interfered with except as is necessary in the interests of national security, public safety, economic well-being of the country, prevention of disorder or crime, protection of health or morals, or protection of rights and freedoms of others).Google Scholar

43 Rauhofer, supra note 37, at 337.Google Scholar

44 Bignami, supra note 1, at 21.Google Scholar

45 Rauhofer, supra note 37, at 338.Google Scholar

46 Id. at 336.Google Scholar

47 See, supra note 39, at 12993.Google Scholar

48 Telekommunikationsüberwachungsgesetz (TKG- Telecommunications Surveillance Act), Jul. 25, 1996, BGB1. I at 1120, last amended by Sixth Law Amending the Law against Restraints of Competition, Aug. 26, 1998, BGB1. I at 2544, chap. 113B, §§ 2–3 (hereinafter TKG).Google Scholar

49 Strafprozessordnung (StPO- Federal Code of Criminal Procedure), Feb. 1, 1877, RGBI. I at 253, chap. 100G, §§ 1–2 (hereinafter StPO).Google Scholar

50 See StPO, chap. 100A, § 2 (including subsidy fraud, treason, endangering public security, counterfeiting, sexual crimes, murder, manslaughter, money laundering, among others).Google Scholar

51 Rotraud Gitter & Christoph Schnabel, Die Richtlinie zur Vorratsspeicherung und ihre Umsetzung in das Nationale Recht, 7 Multimedia und Recht 411, 416 (2007).Google Scholar

52 StPO, chap. 100I, § 2.Google Scholar

53 Pressemappe zum Pressegespräch über die Verhandlung des BVerfGs über die Vorratsdatenspeicherung, Arbeitskreis Vorratsdatenspeicherung, available at <http://www.vorratsdatenspeicherung.de/content/view/51/70/lang,de/>..>Google Scholar

54 See, supra note 39, at 12996.Google Scholar

55 Id. Google Scholar

56 Sabine Leutheusser-Schnarrenberger, Damit wird ein Paradigmenwechsel engeleitet, Berliner Zeitung, Nov. 9 2007.Google Scholar

57 As German procedural law does not recognize class-action lawsuits, these were considered as 34,000 separate suits.Google Scholar

58 Prominent speakers included Rolf Gössner, civil rights activist and lawyer, Dr. Patrick Breyer, jurist and author of the constitutional complaint representing Arbeitskreis Vorratsdatenspeicherung, Dr. Hans-Jörg Kreowski, representing the forum of computer scientists for peace and social responsibility, and Dr. Ralf Bendrath, political scientist and well-known blogger.Google Scholar

59 In determining whether to issue an injunction, the court weighs the public interest in the operation of the law's various provisions versus possible negative effects of allowing the provisions to be immediately implemented in the event that the constitutional complaint is well-founded. The duty of storage provision was immediately implemented and the data release provision suspended because the court linked harmful prejudice to the rights of specific individuals to the latter.Google Scholar

60 BVerfGE 121, 1.Google Scholar

61 Verwaltungsgericht Wiesbaden [VG- administrative court], Case No. 6 K 1045/08.WI, Feb. 27, 2009.Google Scholar

62 Case C-301/06, Ireland v. European Parliament and Council of the European Union, 2009 E.C.R. I-82, paras. 4–5.Google Scholar

63 Press Release, European Court of Justice, No. 70/08 (Oct. 14, 2008), available at <http://curia.europa.eu/en/actu/communiques/cp08/aff/cp080070en.pdf>..>Google Scholar

64 See Basic Law at art. 10, paras. 1–2 (“(1) The privacy of correspondence, posts and telecommunications shall be inviolable. (2) Restrictions may be ordered only pursuant to a law.”)Google Scholar

65 Press Release, German Federal Constitutional Court, no. 79/2009 (Jul. 15 2009), Sicherstellung und Beschlagnahme von E-Mails auf dem Mailserver des Providers nicht verfassungswidrig, available at <http://www.BVerfG.de/pressemitteilungen/BVerfG09-079.html>..>Google Scholar

66 See Basic Law at art. 12, para. 1 (“All Germans have the right to freely choose their occupation, work place, and training institution. The practice of their occupation can be regulated through law or because of law.”)Google Scholar

67 See id. at art. 14, paras. 1–3 (“(1) Property and the right of inheritance shall be guaranteed. Their content and limits shall be defined by the laws. (2) Property entails obligations. Its use shall also serve the public good. (3) Expropriation shall only be permissible for the public good….”).Google Scholar

68 Data Retention Case, supra note 4, at para. 301.Google Scholar

69 The constitution does not contain a categorical division between private and public tasks yielding the disallowance of private performance of state obligations - at private-sector cost - in service of public welfare purposes.Google Scholar

70 Hans-Jörg Albrecht et. al, Rechtswirklichkeit der Auskunftserteilung über Telecommunicationsverbindungsdaten nach chapter 100g, 100h StPO, Max-Planck-Institute for Foreign and International Criminal Law, 2008, at n. 394, available at <http://www.vorratsdatenspeicherung.de/images/mpi-gutachten.pdf>..>Google Scholar

71 Rauhofer, supra note 37, at 335.Google Scholar

72 Data may be given to foreign security agencies without any binding condition on its use.Google Scholar

73 Using the sample ratio of 2.7 data requests per case and 4% sample failed request rate.Google Scholar

74 Hans-Jörg Albrecht et. al, Rechtswirklichkeit der Auskunftserteilung über Telecommunicationsverbindungsdaten nach chapter 100g, 100h StPO, Max-Planck-Institute for Foreign and International Criminal Law: Kriminologische Forschungsberichte [Reports on Research in Criminology] (February 2008), available at <http://www.vorratsdatenspeicherung.de/images/mpi-gutachten.pdf>..>Google Scholar

75 Process whereby all traffic data associated with certain user(s)/IP addresses/number(s) are immediately retained following court order, on a case-by-case basis.Google Scholar

76 Gitter & Schnabel, supra note 51, at 414.Google Scholar

77 StPO § 100a, para. 2.Google Scholar

78 In cases where the preparation activities are not criminal themselves.Google Scholar

79 Gitter & Schnabel, supra note 51, at 414.Google Scholar

80 BVerfGE 107, 299 (para. 75).Google Scholar

81 Id. at para. 77.Google Scholar

82 Gitter & Schnabel, supra note 51, at 416.Google Scholar

83 Considered the most significant of the individual legally protected interests are life, freedom, and bodily health. Universal legally protected interests are legally protected interests assigned the state rather than persons. The weightiest include public security, rule of law, and functional administration of justice.Google Scholar

84 Hans-Jürgen Papier, Gegen die Totalkontrolle, Süddeutsche Zeitung, Mar. 3 2010.Google Scholar

85 Press Release, German Federal Constitutional Court, no. 11/2010 (Mar. 2 2010), Konkrete Ausgestaltung der Vorratsdatenspeicherung nicht verfassungsgemäß, available at <http://www.bverfg.de/pressemitteilungen/bvg10-011.html>..>Google Scholar

86 Data Retention Case, supra note 3 at para. 210.Google Scholar

87 Data Retention Case, supra note 3 at para. 211.Google Scholar

88 Data Retention Case, supra note 3, at para. 222.Google Scholar

89 Data Retention Case, supra note 3, at para. 243.Google Scholar

90 The requests for determination of IP-address are exempted from this. These requests nonetheless require criminal suspicion or concrete danger for specific cases.Google Scholar

91 Data Retention Case, supra note 3, at para. 252.Google Scholar

92 Data Retention Case, supra note 3, at para. 227.Google Scholar

93 Data Retention Case, supra note 3, at para. 228.Google Scholar

94 Data Retention Case, supra note 3, at para. 279.Google Scholar

95 Data Retention Case, supra note 3, at para. 231.Google Scholar

96 Data Retention Case, supra note 3, at para. 232.Google Scholar

97 The bar for disproportionality here is that a group of market actors - not individual firms - faces cost burdens in violation of the Übermaβverbot (prohibition of excessive cost); Oil Reservation Case, BverfGE 1 BvR 52,665,667,754/66 (para. 316).Google Scholar

98 BVerfGE 73, 339 (para. 4).Google Scholar

99 Hornung & Schnabel, supra note 18, at 122.Google Scholar

100 Data Retention Case, supra note 3, at para. 218.Google Scholar

101 Data Retention Case, supra note 3, at para. 337.Google Scholar

102 Heribert Prantl, Arresting the Cyber Police, Süddeutsche Zeitung, Mar. 3 2010 Available at <http://www.presseurop.eu/en/content/article/202721-arresting-cyber-police>..>Google Scholar

103 Stephanie Bolzan, EU-Richtlinie zur Datenspeicherung wird überprüft, Die Welt, Available at: <http://www.welt.de/politik/ausland/article6642536/EU-Richtlinie-zur-Datenspeicherung-wird-ueberprueft.html>..>Google Scholar