Extraterritorial Bulk Surveillance after the German BND Act Judgment

Abstract

Foreign surveillance as a means of circumventing existing legal safeguards – Different perspectives on the problem of the extraterritorial application of fundamental rights in US and EU legal models – The limited usefulness of effective control tests for establishing the responsibility of states for action taken in cyberspace – Judgment of Bundesverfassungsgericht in the BND Act case as an interpretative guideline for the regulation of foreign surveillance in EU member states – Electronic surveillance as a threat to European integration process.

Introduction

A particular type of surveillance is that aimed at gathering information from foreign sources. Its unrestricted use has led to discussion about whether the importance of privacy – consistently highlighted in recent years – has been losing ground when it comes to foreigners.¹ Although, to paraphrase the words of Marko Milanovic, this problem can be reduced to the question ‘Do foreigners deserve privacy?’,² another, equally important issue arises: does the broad, extraterritorial interpretation of fundamental rights guaranteed in democratic countries not make their constitutions a ‘suicide pact’?³ And as a result, is it possible to reconcile compliance with the rule of law – which respects the universal nature of human rights – with an obvious need to ensure the security of a state’s own citizens?

In May 2020, the German Federal Constitutional Court (Bundesverfassungsgericht) issued a landmark judgment in which it determined that certain powers of the Federal Intelligence Service (BND) to carry out foreign-foreign surveillance violated fundamental constitutional rights.⁴ This judgment is worth examining for several reasons. Firstly, the Court made a direct reference to the use of purely foreign-foreign surveillance. Secondly, the judgment was issued by the constitutional court of an EU member state, and therefore took into account the European model of protection of fundamental rights, which stems from both EU law and the European Convention on Human Rights. Thirdly, the Court also addressed in detail the problem of international intelligence cooperation and provided guidelines that might help identify a set of legal safeguards to be applied in the case of cross-border data transfer.

Significantly, the case provided yet another example of the Bundesverfassungsgericht dealing with an assessment of the constitutionality of surveillance regulations through its case law. This most recent judgment can be juxtaposed with earlier, equally important, judgments in the cases of the G10 Act of 1999⁵ and the BKA Act of 2016,⁶ which makes it possible to trace the interpretation of constitutional provisions with regard to the state’s surveillance powers.

The purpose of this article is to discuss the main conclusions of the BND Act judgment from the perspective of transatlantic discussion on the permissible limits of foreign electronic intelligence activities. Therefore, considerable attention will be paid not only to presenting the facts of the case and the judgment, but also to placing considerations concerning the Bundesverfassungsgericht’s position in a broader, supranational context. In the first place, in order to make this analysis possible, the first two sections of this work set out the main differences between domestic and foreign surveillance, as well as the key terms used with reference to electronic surveillance. This will be followed by a summary of views on the problem of regulating foreign intelligence activities from the perspective of both the US and EU legal models. The discussion of the BND Act judgment will be presented in the penultimate section, and its possible impact on European law in the last one.

Domestic versus foreign surveillance in the digital era

The legal systems of most democratic countries have introduced clear restrictions on the admissibility of the activities of foreign intelligence services in their own country. These restrictions are intended to prevent the use of extensive powers in a way that is incompatible with their intended purpose. Foreign intelligence agencies do not conduct criminal proceedings and, as a result, are not bound by the rules that govern these proceedings. Their main objectives are to collect information and provide analyses, as well as anticipate and counteract external threats.

As a result, in democratic countries, the mechanisms used in the areas of domestic and foreign surveillance, although often based on the same technical capabilities, are limited by diametrically opposed legal safeguards. In the case of domestic surveillance, especially conducted as part of criminal procedure, the actions of public authorities need to comply with the principles of subsidiarity, proportionality and strict necessity. Domestic surveillance is also subject to oversight by independent bodies, and individuals subjected to it have legal remedies at their disposal.⁷ However, most of these safeguards do not apply in the case of foreign surveillance. As a result, foreign intelligence has for years been an area where the principles of a democratic state have been applied less conscientiously.

Over the last decade, the issue of ‘overly extensive surveillance powers’ has become a focus of attention for both the public and the scientific community. It has also become a subject of consideration by both constitutional courts and supranational courts. In this regard, particular importance should be attached to the case law of the European Court of Human Rights. The Court has not only developed its own standards for the assessment of national surveillance regulations, but has also used them repeatedly to analyse regulations applied in the area of both national security and the fight against crime.⁸ In recent years, the problem of overly extensive surveillance measures taken by public authorities has also been increasingly addressed by the European Court of Justice.⁹

However, in the case of both European Courts, the problem of surveillance powers has been considered mainly in terms of the negative obligations of the state to refrain from arbitrary interference with the rights of individuals. In other words, in the cases examined, the state applied surveillance measures directly or indirectly to persons under its jurisdiction (so-called domestic-domestic or domestic-foreign surveillance). Clearly, the scope of such surveillance includes the observation of a country’s own citizens (including those residing abroad), as well as persons without this status who are in the area of national jurisdiction of a given state or come into contact with its citizens. Therefore, the surveillance of foreign nationals not subject to the jurisdiction of the country that applies the measure (so-called foreign-foreign surveillance) fell outside the ambit of judicial authorities’ analyses.

The dynamic development of both surveillance regulations and technical possibilities has led to a gradual blurring of the border between surveillance programmes that involve a national link and those of a fully foreign nature. There are two main reasons for this. Firstly, in the age of globalisation the very concept of a ‘national link’ is difficult to define. Clearly, in the case of traditional telephone calls the geographical location of subscribers can be determined relatively simply (e.g. based on the records of the calls); however this ability is no longer straightforward if the same call is made with the use of a VoIP service. Secondly, the increase in technical capabilities has led to closer international intelligence cooperation. Data intercepted in one country can now be quickly shared with foreign partners. As a result, the country that originally collected the information can pass it on to the intelligence services of another country, which a particular person may also have a link with, for example, in the form of citizenship or place of residence.¹⁰

Basic concepts of electronic surveillance

Traditionally, electronic surveillance measures have been divided into targeted and untargeted ones. In the case of targeted surveillance, the authorised bodies are focused on gathering information about specific individuals from the very beginning. Even if it is not possible to identify those persons when initiating the procedures, other selectors (search terms) may be used to limit the scope of surveillance measures. Targeted surveillance has traditionally been associated with the action of law enforcement agencies and the conduct of criminal proceedings, where measures of this kind are applied with external oversight and the legitimacy of the entire process is subject to subsequent review in the course of criminal proceedings.

While targeted surveillance is generally used by law enforcement agencies, untargeted surveillance (often referred to as ‘mass’ or ‘bulk’ surveillance) is the domain of security and intelligence agencies. This is due to the simple fact that untargeted surveillance is from the outset geared towards collecting all available information that may be useful. This ‘usefulness’ should in no way be linked to the ‘necessity’ of gathering this information and the proportionality of the action taken.¹¹

In practice, it is increasingly difficult to identify clear criteria for dividing surveillance techniques into targeted and untargeted ones. This problem has also been the subject of analysis relating to the activities of German intelligence.¹² For several decades, the BND has been monitoring international communication with the use of infrastructure located on German territory in order to gather information and counter serious threats to national security.¹³ The Strasbourg Court has recognised that this type of surveillance – referred to as ‘strategic surveillance’ – does not affect obligations arising from the European Convention.¹⁴ Strategic surveillance is, of course, a form of bulk surveillance, so it is not surprising that the Court’s position has been cited over the years as evidence that this form of surveillance can – at least to some extent – be reconciled with the requirements of human rights systems. It should be recalled, however, that this judgment was delivered more than 15 years ago and concerned surveillance regulations applied in Germany during the 1990s. The bulk interception of communications at that time was much narrower in scope, both in terms of the types of information collected and its size.

Different perspectives on the extraterritorial application of fundamental rights

Placing foreign-foreign surveillance within existing legal frameworks applied in the area of national surveillance requires two basic issues to be resolved. The first is whether this type of activity by public authorities is subject to any restrictions based on a need to respect the fundamental rights of foreigners. Only a positive answer to this question will make it possible to define the source of this obligation and, as a result, to identify the legal safeguards which should apply in this area.

The concept of exterritorial application of constitutional provisions is perceived differently in different legal systems. Excluding undemocratic states and taking into account the scale of surveillance programmes undertaken, it is necessary in the first instance to present American and European doctrines in this field.

The United States

US electronic surveillance programmes are among the most extensive in the world. At the same time it should be borne in mind that both federal and state regulations introduce a number of restrictions on the use of domestic surveillance.¹⁵ However, these restrictions do not apply to foreign programmes, for three main reasons: (i) a lack of recognition of the right to privacy in the catalogue of fundamental rights; (ii) the broad powers of the executive in the area of national security ; and (iii) the limited effectiveness of human rights treaties in domestic law.

The fundamental source of the right to privacy in the US Constitution is the Fourth Amendment. However, the Fourth Amendment does not de facto define the subjective right of individuals, but rather sets out the duty of the state to refrain from ‘unreasonable searches’.¹⁶ Consequently, the Fourth Amendment explicitly refers to the relationship between the citizen and the State and is a source of legal safeguards binding on domestic surveillance. In principle, it applies to American citizens and residents.¹⁷

As early as 1972, the US Supreme Court, in its landmark judgment in the Keith case, ruled that electronic monitoring of national communications within the United States must be carried out subject to the Fourth Amendment.¹⁸ Nevertheless, in its 1990 Verdugo-Urquidez judgment, the Supreme Court ruled that the Fourth Amendment did not apply to searches carried out by federal agents with respect to foreign nationals’ property located outside the United States.¹⁹ The Court explained that ‘[n]either the Constitution nor the laws passed in pursuance of it have any force in foreign territory unless in respect of our own citizens’.²⁰ This view expresses the conviction of US jurisprudence that the real purpose of the Fourth Amendment was not to restrict public authorities, but to protect citizens’ rights.²¹ In this sense, the protective function of the law must be linked to its applicability. In the opinion of the US Supreme Court, in an area where the state’s jurisdiction does not extend, not only is there no need for measures limiting the government’s actions, such measures may in fact harm the public interest.²² A narrow interpretation of the scope of application of the Fourth Amendment, limiting it only to persons who ‘are part of a national community or who have otherwise developed sufficient connection with (…) the country to be considered part of (…) community’ leads to the conclusion that the activities of public authorities – including those related to electronic surveillance – carried out in relation to foreigners abroad are not subject to constitutional restrictions. This interpretation of the provisions of the Fourth Amendment has also been confirmed by subsequent case law, in particular the case of Hernandez v Mesa, in which the Court found that the activities of government representatives carried out on United States territory, but where their effects materialised abroad, did not violate the guarantees of the Fourth Amendment.²³

When discussing the US legal model, it is necessary to take into account the relatively minor role played by international law in shaping the area of fundamental rights. The United States is a party to the International Covenant on Civil and Political Rights and subject to guarantees regarding the protection of privacy that are laid down in Article 17(1) of the Covenant. As a result, it is also subject to an obligation to refrain from using disproportionate surveillance measures.²⁴ However, the scope of the Covenant’s guarantees, although not limited only to citizens, extends solely to persons ‘within the territory and subject to the jurisdiction’ of a state party.²⁵ This interpretation of the Covenant has also been confirmed in general comments from the Human Rights Committee.²⁶ Although this view has evolved in recent years, and there is an increasing likelihood of an interpretation extending the obligations of states to activities also undertaken abroad,²⁷ there is as yet no basis for recognising the extraterritorial effect of the Covenant in cases where the state does not exercise effective control over an individual.²⁸ Moreover, due to the notification of derogation and interpretation clauses by the United States during the process of ratifying the Covenant, its practical value in resolving cases before national courts is limited.²⁹

The exclusion of US constitutional provisions and the ineffectiveness of international law, combined with the broad powers of the executive to introduce measures for national security purposes, effectively mean that most legal safeguards established in the area of domestic surveillance (in particular, the constitutional ‘probable cause’ test) do not apply to foreign-foreign types of surveillance programmes carried out by the US intelligence agencies.³⁰

The European Union

Compared to the United States, EU member state institutions of international law are given a much greater role in shaping the standard of human rights protection. A special role in this regard is enjoyed by the Strasbourg Court, which has produced a wealth of case law, although in recent decades the Luxemburg Court has also frequently spoken out on issues concerning the protection of fundamental rights.

At the same time, however, the lack of EU competence in the area of national security should not be ignored – resulting as it does from both the current wording of the national identity clause³¹ and from a specific regulation confirming the exclusive competence of member states relating to transnational cooperation in the area of national security.³² The activities of security and intelligence agencies have also been explicitly excluded from the jurisdiction of the European Court of Justice.³³ Yet the Court has spoken out in areas which do not directly concern the legality of actions taken by public authorities, but refer to the compatibility with EU law of obligations imposed on private entities. One example is the extensive jurisprudence issued in cases regarding the general obligation to retain telecommunications data.³⁴

The case law of the European Court of Human Rights can have a much greater impact on member states’ national law applied in the area of surveillance. The scope of European Convention guarantees is not excluded from the area of national security, which is why the Strasbourg Court has the competence to assess the compliance of both national and foreign surveillance programmes with human rights standards. At the same time however, the vast majority of judgments by which the Court has developed its own standard for assessing surveillance provisions concern cases of domestic surveillance.³⁵ Only three cases explicitly cover the use of foreign surveillance. The first of these judgments, related to BND-led programmes, was handed down in 2006.³⁶ The other two cases, concerning the assessment of UK³⁷ and Swedish³⁸ surveillance programmes, were resolved in 2018, though these judgments are not yet final.

In the German case, the Court did not explicitly address the problem of the legality of foreign surveillance. According to current terminology, however, this case relates more to ‘international surveillance’ (that is, a domestic-foreign one, not of a purely foreign nature). In examining the case, the Court did not address the extraterritorial application of the European Convention, in particular the issue of whether the obligations imposed on states in relation to respect for the rights of individuals also cover foreigners located in third countries. In earlier judgments the Court made it clear that ‘the Convention is a multi-lateral treaty operating (…) in an essentially regional context and notably in the legal space of the Contracting States. (…) The Convention was not designed to be applied throughout the world, even in respect of the conduct of Contracting States’.³⁹ The issue of cross-border use of surveillance was – albeit only partly – addressed in the Big Brother Watch and Others v the United Kingdom case, where the Court accepted that the interception of foreign electronic communications fell under the jurisdiction of the United Kingdom and therefore under the obligations laid down in the Convention.⁴⁰ This view, if supported by the Grand Chamber⁴¹ and developed in subsequent judgments, could affect the interpretation of the European Convention on Human Rights’ scope in relation to extraterritorial events. In case law to date, the Court has used the criterions of ‘effective control’⁴² as a condition of the state’s responsibility for actions taken outside its territory.⁴³

Hence, the jurisprudence of the European Courts to date does not contain an unambiguous interpretation of whether – and if yes, how – obligations to respect fundamental rights should be met by states in foreign bulk surveillance operations.⁴⁴ But given the crucial function of human rights systems in promoting and supporting action in the area of fundamental rights, it is difficult to reasonably assume that the negative obligations of states (to refrain from arbitrary interference) could be completely disregarded with reference to action taken against foreigners located in third countries.

Such a conclusion is supported by analysis of the Strasbourg Court case law regarding the concept of preserving legal space.⁴⁵ It applies to cases where a state party to the Convention takes action which results in gaining control of part of another state party’s territory. In such a case, in line with the Court’s position, all persons under the control of the occupying State should be granted all the rights which they enjoy under the Convention. This would prevent individuals from finding themselves in a ‘legal vacuum’, where their rights were threatened due to their home country’s lack of control over the area in which they resided. Referring the concept of ‘preserving the legal space’ of electronic surveillance implies that the provisions of the Convention should be applied to programmes carried out with regard to nationals and legal residents of another state party to the Convention, even if these activities are undertaken abroad.

The Bundesverfassungsgericht judgment in the BND Act case

In its judgment of 19 May 2020, the Federal Constitutional Court addressed doubts regarding compliance with the fundamental rights of the legal framework for foreign-foreign type bulk surveillance. The Court made it clear that fundamental rights enshrined in the German Constitution were binding not only on German soil – and specifically those activities undertaken by the public authorities – but also in relation to foreigners remaining outside the jurisdiction of the German state. However, this conclusion should not be equated with a need to afford foreigners residing abroad the same protection as their own nationals or foreigners living under the jurisdiction of German law. Moreover, the Court pointed out that, as a rule, the use of bulk surveillance might be a constitutionally justified measure in the area of foreign intelligence – provided that appropriate legal safeguards were applied.⁴⁶

The following sections present the factual background of the case under examination, as well as selected arguments discussed by the Court.⁴⁷

Context of cited case: the BND’s surveillance powers

The functioning of the BND in the field of electronic intelligence is governed by two basic laws: the BND Act⁴⁸ and the G10 Act.⁴⁹ The former defines the general competence of the agency to collect intelligence related to the area of state security.⁵⁰ This standard forms the basis for the conduct of foreign electronic intelligence activities. The G10 Act regulates the application of measures interfering with the constitutional right to confidentiality of correspondence and telecommunications – guaranteed in Article 10(1) of the Basic Law (Grundgesetz). Therefore, the G10 Act refers to cases of the surveillance of persons under the protection of German constitutional provisions.

In the G10 Act, the German legislature regulated powers and restrictions relating to both targeted⁵¹ and untargeted⁵² surveillance. The purpose of targeted surveillance is, amongst other things, to fight against crime, while bulk surveillance (or ‘strategic surveillance’) aims to gather intelligence and counteract external threats.

The application of strategic surveillance is within the exclusive competence of the BND, and, until the end of the Cold War, its sole purpose was to collect information in order to predict an armed attack on Germany.⁵³ With the fall of the Berlin Wall, this aim of intelligence activity gradually lost its importance. As a result, the legislature passed an amendment to the regulations in 1994, extending the existing catalogue of tasks carried out within the framework of electronic intelligence to the detection of other serious international threats, such as terrorism, arms trafficking and drug trafficking, as well as money laundering and counterfeiting.⁵⁴ The result was a significant extension of the BND’s power to collect data not directly related to threats to national security.⁵⁵

The issue of the compatibility of the BND’s new powers with the German Constitution was the subject of three constitutional complaints, jointly examined by the Bundesverfassungsgericht in its judgment of 14 July 1999. The Court found that, in principle, strategic surveillance was compatible with the Basic Law,⁵⁶ though at the same time pointing to the need to amend a number of specific regulations. In addition, it referred to the problem of whether the activities concerning the collection of foreigners’ data were subject to the regime resulting from the G10 Act. Since both the interception and subsequent analysis of the data took place on German territory, the Court found that the process was under the control of the public authorities and within the jurisdiction of national law.⁵⁷ As a result, any assessment of its legality had to take into account the proportionality of the interference. Significantly, the Bundesverfassungsgericht explicitly stated that its analysis did not refer to any surveillance other than that regulated under the G10 Act, meaning that foreign-foreign type of surveillance had not been taken into consideration.⁵⁸ The compatibility with the fundamental rights of strategic surveillance carried out by the BND became the subject of a complaint to the European Court of Human Rights. In principle the Strasbourg Court supported the line of jurisprudence taken by the Karlsruhe judges, confirming the compatibility of conducting strategic surveillance (based on the provisions of the G10 Act) with the European Convention on Human Rights.⁵⁹

The German authorities have argued for many years that the constitutional guarantees related to the confidentiality of communications do not apply to communications between persons who are not within the jurisdiction of German law.⁶⁰ As a result, foreign surveillance programmes were presumed not to be subject to the restrictions of the G10 Act – whether in terms of the purpose of the surveillance carried out, the legal safeguards applied, or the external control of surveillance measures. Although the Bundesverfassungsgericht judgment of 1999 did not predetermine the correctness of such an interpretation, neither did it offer any arguments to show that it was incorrect. As a result, for many years, the operation of such programmes was based solely on internal government and BND regulations.⁶¹

Another important reform of the BND’s powers was carried out in 2016 with the aim of clarifying the provisions of the BND Act, including the scope of tasks to be undertaken by foreign surveillance. The amended regulations also set out the principles for conducting surveillance with regard to public authorities and citizens of other EU member states, the most important of which is the fulfilment of the necessity condition.⁶² This criterion has not been defined in relation to the interception of transmissions of non-EU citizens. This is an interesting distinction – it shows that the standard of protection of EU citizens’ rights introduced by the German legislature is higher than in the case of other foreigners, while at the same time the former have not been granted the same protection enjoyed by persons under German jurisdiction (to whom the G10 Act would apply).⁶³ Other significant consequences are also linked to the granting of higher protection only to persons with EU citizenship and not to those residing legally in the EU. The scope of application of the new regime under the BND Act does not, therefore, extend to all persons in the EU legal space.

There is no doubt that the shape of the new regulations was influenced by echoes of the US National Security Agency (NSA) surveillance activities revealed by Edward Snowden. One of the topics widely discussed in the media was the cooperation of the BND with its American partner. As a result, the detailed provisions of the BND Act exclude the possibility of carrying out the surveillance of foreigners if the purpose of such activity is economic espionage⁶⁴ or the deliberate collection of data on heads of governments of other EU countries.⁶⁵

The amended law also laid down rules for conducting intelligence cooperation with other countries, including criteria for the transfer of data and conditions for the legality of such transfers. A requirement was introduced to formalise this type of cooperation and to obtain external approval for its initiation.⁶⁶ The legislature also defined the conditions which must be met for intercepted data to be automatically transferred to foreign intelligence services.⁶⁷

It is worth pointing out that one of the main objectives of this reform seems to have been – rather than equating the legal protection of foreigners and persons under German jurisdiction – to protect the constitutional order by ensuring that the BND’s powers would not be used to build a surveillance mechanism that could serve purposes other than those for which the service was established. This is a significant difference, explaining why the amendment to the BND Act does not refer to the concepts of subsidiarity or proportionality as conditions limiting the scope of mass surveillance programmes.

The Bill extending the surveillance powers of the BND was criticised by non-governmental organisations as early as the parliamentary work stage.⁶⁸ The basic charges included that overly extensive powers were granted to the BND, and that it provided for the creation of a distinct procedure for managing and controlling surveillance measures, separate from that provided for in the G10 Act. Shortly after the adoption of the new regulations, they were appealed against in the Federal Constitutional Court.⁶⁹ The complainants raised three main legal issues: (1) infringement of Article 5(1), to the extent that the new powers of the BND could lead to a violation of the freedom of the press; (2) infringement of Article 10(1), i.e. confidentiality of correspondence; and (3) infringement of Article 3(1), to the extent that the contested provisions could discriminate against EU citizens by granting them a different (lower) level of protection against surveillance from that enjoyed by German residents. Thus, unlike in the G10 Act Case of 1999, the key aspect of this complaint was to assess the adequacy of the legal safeguards used in foreign surveillance.

Exterritorial effect of the German Basic Law

The first problem that needed to be resolved by the German Constitutional Court when assessing the legality of foreign surveillance programmes was the possibility of granting foreigners abroad protection arising from fundamental rights guaranteed by domestic constitutional provisions. In its argument, the German Constitutional Court – instead of following the doctrine of effective control over territory or effective control over an individual – presented its own analysis, in which the starting point was the absolute inviolability of human dignity arising from the Basic Law.

Dignity, as a source of other fundamental rights, is of cardinal importance, and is not subject to any restrictions.⁷⁰ Christoph Enders sees it not as a kind of ‘super-basic-right’, overriding other fundamental rights, but as a raison d’être.⁷¹ As a result, the Court has recognised in its case law that even public security objectives do not justify the introduction of measures that violate human dignity.⁷² Moreover, it has stressed that any law that leads to a violation of dignity must be considered unconstitutional.⁷³

According to Article 1(3) of Grundgesetz, fundamental rights are directly applicable and binding on all state authorities – executive, legislative and judicial.⁷⁴ Against that background, the Court noted that this provision does not introduce any territorial restriction. It is therefore reasonable to conclude that all actions of public authorities are limited by the need to respect fundamental rights, irrespective of whether their effects relate to a person under German jurisdiction or not.⁷⁵ The Court pointed out that the interpretation of fundamental rights, as provided for in the German Constitution, cannot disregard the international system of human rights, which is based on the universal recognition of their inviolability and their inalienable nature.⁷⁶

As a result, it was the Court’s view that a commitment to the rule of law and democratic model of the state based on respect for human dignity prevents state authorities from respecting only the fundamental rights of persons with German nationality or who are on German territory. At the same time, the Court stressed that this extended application of fundamental rights does not lead to an obligation of public authorities to ensure the protection of individuals who are in foreign jurisdictions. Nor does it limit in any way the sovereign right of other states to freely formulate their domestic law. The extraterritorial effect of fundamental rights guaranteed by the German Constitution imposes an obligation on the public authorities in Germany to respect such rights in all actions they take – including those relating to foreigners residing abroad.⁷⁷ In this regard, it is irrelevant whether the state exercises effective control over territory or over an individual. For this reason, it is the opinion of Başak Çali that the type of extra-territorial doctrine that the Bundesverfassungsgericht has applied should be referred to as ‘control over the rights of persons’.⁷⁸

Notably, when applying the ‘effective control’ tests, the state has not only negative but also positive obligations to implement adequate mechanisms to protect the rights of individuals. However, in the case of foreign-foreign surveillance, these obligations apply only to the relationship between the individual and the German state.⁷⁹ Nonetheless, it also should be noted that, as Russel A. Miller⁸⁰ and David Krebs⁸¹ point out, the BND Act judgment may be considered a sanction of the exterritorial applicability of fundamental rights related to scenarios other than electronic surveillance.

Bulk surveillance as a constitutionally justified measure of foreign surveillance

The Federal Constitutional Court determined that the general mechanism established in the amended BND Act – which consisted of creating a separate (and lower) protective regime for the use of foreign surveillance than that based on the G10 Act – was unconstitutional. However, this incompatibility did not result from regulating foreign surveillance differently, but from the establishment of inadequate legal safeguards, which failed to take into account the constitutional standard developed by the Court in its earlier rulings, as well as established case law of the European Court of Human Rights.

In its earlier judgment in the Census Act case, the Bundesverfassungsgericht had already ruled that the functioning of the individual in society implies that he or she will tolerate restrictions that arise from the need to protect the public interest.⁸² However, this expression of the principle of proportionality is no longer relevant with regard to foreign surveillance. Two questions arise from this: How is the subjection of a foreigner residing abroad to surveillance connected with his or her functioning within the local community? Why should the introduction of such a restriction be considered justified when it does not ensure the general safety of the society in which the individual functions? The answer to these questions lies in clarifying whether the use of bulk surveillance can be regarded as a necessary measure to achieve a recognised objective of a democratic state, that is, to ensure public security. The Bundesverfassungsgericht explained that the use of bulk data collection is indeed necessary – because only in this way is it possible to carry out analyses that may lead to identifying sources of potential threats to state security.⁸³ The Court stressed that there are no other less intrusive ways to achieve this goal; in particular, no narrower, more selective collection of data. This is one of the key arguments supporting the judgment, because it leads to the conclusion that, in principle, mass surveillance can be reconciled with the values of a democratic state governed by law, and the way in which it operates.⁸⁴ The Court reached this conclusion based on the way BND programmes are implemented, in which data is gathered with the use of selectors so that the amount of data collected can be progressively reduced at subsequent stages of automatic processing.⁸⁵ At the same time, however, the Court noted that the selection of search terms, as well as the collection, processing and use of data, must be subject to detailed legal regulation.⁸⁶ Therefore, it defined guidelines that the legislature should take into account so that the final shape of the new surveillance regulations would be in line with the Basic Law.

The Court also reiterated that general security objectives cannot be regarded as sufficient justification for interference in a strictly protected area of individual privacy.⁸⁷ As a result, it was the Court’s view that legal safeguards applied in the area of foreign surveillance must include both the prohibition of selectors aimed at collecting sensitive information, and the obligation to remove this kind of information at the stage of manual analysis⁸⁸ if it has been collected accidentally.⁸⁹

Data sharing regime and international intelligence cooperation

In its earlier case law, the Bundesverfassungsgericht not only approved the admissibility of automatic data transfer abroad, it also stressed the importance of maintaining the ‘principle of reciprocity’ for the success of international intelligence cooperation.⁹⁰ However, in the BND Act judgment, the Court considered the current legal regime for cross-border data transfers to be incompatible with the Basic Law.⁹¹ The Court reiterated its previous position in this respect, as presented in the BKA Act case.⁹² First of all, it stressed that one condition governing the transfer of data is to ensure that it is not used in a way that is incompatible with the purpose of its collection, and that equivalent legal remedies are available to individuals under surveillance in the receiving countries. Significantly, as the Court pointed out, the transfer of data cannot be based on a discretionary political decision and must be based on verifiable, up-to-date and reliable information, so that it can be subjected to independent scrutiny.⁹³

Due to constitutional provisions, the Court ruled out the possibility of transferring data to recipients who could use it in a way that violated human dignity (including for the purposes of political struggle or inhuman or inhumane treatment).⁹⁴ Although the wording of the BND Act judgment does not explicitly refer to the BND’s cooperation with the NSA, this context cannot be ignored – especially given the importance of this cooperation as a premise for the introduction of the provisions under constitutional review. This cooperation consisted not only of transferring data to the NSA, but also of using selectors defined by the US partner. In this regard, the question was raised as to whether the use of BND powers to collect data that had been received by the foreign service influenced in any way the achievement of German intelligence’s statutory objectives. An indirect response to this issue can be found in the BND Act requirement that the future transfer of data to a foreign partner should be permissible only if it does not jeopardise guarantees relating to respect for the fundamental right to personal data protection.⁹⁵ Although the Court did not refer to the concept of adequacy of safeguards, as enshrined in EU data protection law,⁹⁶ it follows from the arguments presented that it is not possible to carry out data transfers to a third country if its legal model does not provide for systemic protection of personal data.⁹⁷

While the considerations presented in the BND Act judgment almost reproduce the arguments presented in the BKA Act case, it should be borne in mind that in its most recent judgment the Court referred to the activities of intelligence services – not only of law enforcement agencies. Moreover, in the BKA Act case, only transfers of data to security and intelligence agencies in third countries (outside the EU/EEA) were examined, whereas the BND Act judgment does not contain such a limitation. As a result, although the constitutional standard defined in both cases is very similar, it was applied to a wider extent in the BND Act judgment.

The impact of the judgment in the BND Act case on European law

From the perspective of seeking a common European consensus on the limits of permissible foreign surveillance, the judgment in the BND Act case is important for several key reasons.

Firstly, the Bundesverfassungsgericht was the first EU constitutional court to make a direct statement on the need to apply fundamental rights – the common acquis of the European legal model – to all activities of public authorities, including those carried out abroad. Although this judgment does not in any way bind other constitutional courts, the position of the Karlsruhe judges will certainly be examined in detail in the capitals of other European countries. The way in which fundamental rights are defined and protected in these countries is almost identical, which obviously results from the fact that their national legal systems have been under the influence of European Court of Human Rights case law for more than sixty years, as well as from integration processes within the EU, which have taken place for almost as long. Hence, although this argument can be described as speculative, it seems unlikely that a similar analysis of the extraterritorial effect of fundamental rights by the constitutional court of another EU member state would lead to significantly different conclusions.

Secondly, the German surveillance regulations are – also when compared to other EU member states – a rare example of the national legislature deciding to clarify the competence of intelligence services for foreign electronic surveillance programmes. In the vast majority of European countries such provisions do not exist, and foreign intelligence agencies’ power to conduct surveillance programmes is derived from blanket statutory powers.⁹⁸ Thus, the Bundesverfassungsgericht judgment not only supports the concept of the extraterritorial effect of fundamental rights, but it also contains an important analysis that helps determine a feasible standard of legal safeguards that should be implemented. In this context, ‘feasible’ refers to a type of control that, without paralysing the operation of intelligence services, puts the area of foreign-foreign surveillance under a supervision and control regime applicable to other surveillance measures. From the perspective of those EU countries where there are no provisions similar to those assessed by the Bundesverfassungsgericht, this judgment may therefore provide important guidance on how to shape future national regulations to take due account of the requirements of proportionality and necessity.

The BND Act judgment may also be helpful in developing a common standard for the cross-border exchange of information within the framework of criminal and national security cooperation. These two areas of supranational cooperation intermingle.⁹⁹ Information obtained as part of intelligence activities is used in the area of combating serious crime. Cooperation in criminal matters is also subject to EU regulations, but only to the extent that it does not cover the area of national security.¹⁰⁰ At the same time, however, the very decision to transfer data constitutes an interference with fundamental rights.¹⁰¹ Therefore, the Bundesverfassungsgericht judgment may be helpful in defining a common minimum standard of safeguards to be applied as part of agreements – including those concluded under Article 73 of the TFEU – so that both the scope of the data transferred and the way in which it is used are similarly defined and interpreted, regardless of whether the transfer of data takes place in the sphere of the fight against serious crime or in pursuit of national security objectives.

Unfortunately, the Bundesverfassungsgericht avoided taking a stance on possible discrimination against EU citizens resulting from the establishment of separate laws governing the use of surveillance. In the opinion of the Karlsruhe judges, answering this question will be possible if – first and foremost – the scope of the national security clause provided for in Article 4(2) of the TEU is clarified under EU law. If the BND’s activities related to foreign surveillance fall, even partially, within the scope of EU law, then the assessment of possible discrimination against EU citizens must take into account the provisions of the Charter of Fundamental Rights and the case law of the Luxembourg Court.

At the time of the Bundesverfassungsgericht judgment,¹⁰² the European Court of Justice was examining questions referred for a preliminary ruling concerning the issue of whether and to what extent member states may apply a general data retention obligation in order to collect metadata derived from electronic communications and transmit them to national intelligence services. The Bundesverfassungsgericht considered that the answer to these questions was crucial in clarifying the scope of application of EU law to foreign surveillance. In judgments delivered on 6 October 2020, the Court of Justice, following the opinion of the Advocate General,¹⁰³ held that member states cannot invoke the exemption relating to the pursuit of national security objectives when they impose, by means of national law, an obligation to carry out specific tasks (such as a general data retention obligation) on commercial entities.¹⁰⁴ The judgment in the Privacy International case, although it confirms the incompatibility of the general data retention obligation with EU law, has not contributed to a significant clarification of the national security clause’s limits. In particular, the ruling does not indicate clearly whether the activities of countries implementing extensive surveillance programmes that enable the interception of bulk quantities of data from other member states actually comply with EU law. Inasmuch as the Bundesverfassungsgericht did not decide to formulate its own preliminary questions in this area,¹⁰⁵ this problem should not be expected to be resolved in the near future.

Conclusions

The judgment in the BND Act case is in line with ongoing discussion on the need to control electronic intelligence activities in democratic countries. The construction of the post-war human rights system was based on a supranational consensus that fundamental rights are universal, inalienable, and inviolable. Modern democracies, whose common feature is respect for human dignity, should not apply double standards depending on the geographical location of the person under surveillance.

The need to follow the same basic principles for regulating foreign surveillance as those governing various forms of national surveillance is not only based on moral concerns, but also practical ones. Assuming that cooperation between intelligence services is desirable and increases the effectiveness of their actions, it is also necessary to adopt a legal framework which will not be an obstacle to the transfer of data obtained from surveillance. The introduction of different rules for domestic and foreign surveillance clearly creates such a barrier and – as shown by information revealed on cooperation between the NSA and European intelligence services – a real possibility of abuse. Any attempt to refer territorially-defined surveillance procedures to transnational digital services would lead to opaqueness and be difficult to monitor, and therefore less effective and more prone to error.

However, recognition of the extraterritorial application of fundamental rights in the area of foreign surveillance does not necessarily lead to the introduction of the same legal restrictions as those applicable to domestic surveillance. Compliance with the principle of proportionality requires weighing the interests at stake and demonstrating the need for the interference in question. Even in the BND Act judgment, the Bundesverfassungsgericht pointed out that foreign intelligence activities involving the collection of electronic data are characterised by a lower degree of interference than identical measures that are applied domestically.¹⁰⁶ This is due to the simple fact that the individual is not subject to state control. In a similar way, it is possible to consider that some legal safeguards – such as the information obligation towards the individuals concerned – do not apply to foreign intelligence activities. This, however, does not affect the conclusion that foreign surveillance programmes should be carried out in accordance with the rule of law and not lead to a violation of human dignity. Therefore, programmes of this type, especially if they are based on the bulk collection of data, should be implemented with the use of externally-evaluated, detailed procedures that minimise the scope of the data collected and processed.

The impact of the BND Act judgment on the discussion concerning the scope of admissible surveillance undertaken in European countries seems particularly interesting.¹⁰⁷ The constantly evolving process of digitisation means that more and more activities of both individuals and public authorities are being carried out by means of IT systems. The EU’s current strategy and priority is to transform members’ economies to ones based on knowledge and data. However, the success of the project to build a single digital market requires member states to refrain from using measures that could constitute an obstacle to its operation. In the digital world, such a measure, in addition to the classic economic mechanisms of state influence on the economy, may also lead to the use of unlimited surveillance. The bulk interception of communications from other member states is not necessary to protect national security. Similarly, cooperation with the intelligence services of third countries in order to eavesdrop on European neighbours does not strengthen mutual trust among EU countries. As a result, the question of the scope of admissible electronic surveillance aimed at other member states is, in fact, a question about the future of European integration, i.e. whether it will remain a mechanism of limited economic cooperation, or if it will develop into a supranational union of values.