• Home /
• News /
• 2021 /
• January /
• Germany: Data-mining of joint police-intelligence system ruled unlawful

Germany: Data-mining of joint police-intelligence system ruled unlawful

Topic

Country/Region

14 January 2021

In December, Germany's Federal Constitutional Court published a November ruling which found that legislation allowing police forces and intelligence agencies to engage in the "mining" of a joint database is unconstitutional. The Court ruled that the legislation in force did not meet a number of requirements that would make such actions permissible, namely: the existence of "a sufficiently identifiable danger" in the case of "averting dangers to public security"; for undertaking intelligence analysis, "investigating a specific action or group that warrants surveillance by intelligence services in the individual case"; and for law enforcement purposes, "a suspicion based on specific facts must exist in respect of which specific circumstances have taken shape that support the suspicion."

Press release published by the German Federal Constitutional Court on 10 November 2020, original available here.

Extended data use (“data mining”) pursuant to the Counter-Terrorism Database Act is in part unconstitutional

Press Release No. 104/2020 of 11 December 2020

Order of 10 November 2020
1 BvR 3214/15 (Germany, pdf)

In an order published today, the First Senate of the Federal Constitutional Court held that § 6a(2) first sentence of the Act on Establishing a Standardised Central Counter-Terrorism Database for Police Authorities and Intelligence Services of the Federation and the Länder (Gesetz zur Errichtung einer standardisierten zentralen Antiterrordatei von Polizeibehörden und Nachrichtendiensten von Bund und Ländern, Antiterrordateigesetz, Counter-Terrorism Database Act – ATDG) is incompatible with Art. 2(1) in conjunction with Art. 1(1) of the Basic Law (Grundgesetz – GG) and therefore void. For the remainder, § 6a ATDG is compatible with the Constitution.

The primary purpose of the Counter-Terrorism Database Act, which entered into force in 2006, was the creation of a joint database for different security authorities, essentially facilitating inter-agency information requests. Following the Federal Constitutional Court’s Judgment of 24 April 2013 - 1 BvR 1215/07 - (Decisions of the Federal Constitutional Court, Entscheidungen des Bundesverfassungsgerichts – BVerfGE 133, 277 ff. – Counter-Terrorism Database Act I), whereby the First Senate declared several provisions of the Act to be incompatible with the Basic Law, the federal legislator amended the provisions that had been declared incompatible and inserted § 6a ATDG on “extended project-related data use” into the Act. Pursuant to § 6a ATDG, security authorities may engage in what the amendment calls extended use (“data mining”) of the data stored in the counter-terrorism database, which goes beyond facilitating requests for information and also covers operational measures. Thus, § 6a ATDG permits direct use of the counter-terrorism database, including generating new intelligence from the relationships between the stored data. Such use had previously only been permissible in urgent cases.

• 6a(2) first sentence ATDG violates the complainant’s fundamental right to informational self-determination following from Art. 2(1) in conjunction with Art. 1(1) GG. The provision does not satisfy the special constitutional requirements deriving from the standard of a hypothetical recollection of data, which is applicable here in view of the principle of separation of police and intelligence data. Given the heightened impact on fundamental rights of extended use of a joint database for police authorities and intelligence services, such use must serve to protect especially weighty legal interests and must be subject to sufficient thresholds for carrying out measures constituting interference that are set out in precisely defined and clear provisions. § 6a(2) first sentence ATDG does not satisfy these requirements, whereas the remainder of § 6a ATDG does satisfy them.

Facts of the case:

The counter-terrorism database is a joint database for police authorities and intelligence services of the Federation and the Länder that serves to combat international terrorism. For standard cases, § 5(1) no. 1(a) ATDG only permits authorities entitled to submit requests to directly access the basic data stored in the counter-terrorism database to identify those persons who were the object of the request; such data includes name, sex and date of birth (§ 3(1) no. 1(a) ATDG). This access does not cover the extended data stored in the database (§ 3(1) no. 1(b) ATDG), which includes bank account details, marital status and ethnicity, unless an exception for urgent cases applies, and then only subject to strict conditions.

• 6a ATDG was inserted into the Act by the Act Amending the Counter-Terrorism Database Act and other Acts (Gesetz zur Änderung des Antiterrordateigesetzes und anderer Gesetze) of 18 December 2014 and entered into force on 1 January 2015. Under certain conditions and in the context of a “project”, the provision permits the extended use of the types of data stored in the database pursuant to § 3 ATDG. Hidden data reserved for qualified access pursuant to § 4 ATDG is excluded from such extended use. § 6a(1) to (3) ATDG distinguish between the different purposes of extended use: § 6a(1) ATDG permits extended use in the context of a specific project in the individual case to gather and analyse information on international terrorist activities, § 6a(2) first sentence ATDG permits such use for the prosecution of qualified criminal offences of international terrorism, and § 6a(3) first sentence ATDG permits such use for the prevention of such qualified criminal offences.

In § 6a(5) ATDG, the legislator defines the term ‘extended use’. It includes establishing connections between persons, groups of persons, institutions, objects and matters, excluding insignificant information and intelligence, associating incoming information with known facts and statistically analysing stored data (first sentence). In this context, the federal authorities involved may also request data by entering phonetic or incomplete data, searching across several data fields, linking persons, institutions, organisations or matters, or by limiting search criteria to a certain time period; they may also make use of territorial or other connections between persons and of links between persons, groups of persons, institutions, objects and matters and prioritise certain search criteria (second sentence). Thus, § 6a ATDG authorises the direct use of the counter-terrorism database to generate new intelligence from the relationships between the stored data (so-called data mining).

With his constitutional complaint, the complainant challenges only § 6a ATDG, claiming that his fundamental right to informational self-determination (Art. 2(1) in conjunction with Art. 1(1) of the Basic Law) has been violated.

Key considerations of the Senate:

The constitutional complaint is admissible and, in part, well-founded. § 6a(2) first sentence ATDG violates the right to informational self-determination following from Art. 2(1) in conjunction with Art. 1(1) GG. For the remainder, the constitutional complaint is unfounded.

• 6a(1) to (3) ATDG interferes with the right to informational self-determination following from Art. 2(1) in conjunction with Art. 1(1) GG as it permits the authorities involved the extended data use of the types of data stored in the database pursuant to § 3 ATDG, with the exception of hidden data stored in the database pursuant to § 4 ATDG.

The interference resulting from § 6a(2) first sentence ATDG is not justified. The provision is disproportionate.

1. Provisions authorising data sharing between police authorities and intelligence services must satisfy the special constitutional requirements deriving from the standard of a hypothetical recollection of data, which is applicable here in view of the principle of separation of police and intelligence data. The specific impact on fundamental rights of such powers determines the detailed requirements that must be met with regard to the protection of legal interests and the threshold for interference.
2. Extended data use pursuant to § 6a ATDG entails a heightened impact on fundamental rights. Therefore, new intelligence and facts obtained by combining data from different intelligence and police sources stored in a single database must serve an exceptionally significant public interest. Furthermore, the interference must be tied to sufficiently specific thresholds in respect of extended use for the purposes of averting dangers to public security, law enforcement and the performance of tasks of authorities that do not have operational powers, such as intelligence services; it must also be based on clear provisions,.
3. a) Due to its impact on fundamental rights, extended use of the counter-terrorism database for the purpose of averting dangers to public security requires at least the existence of a sufficiently identifiable danger (hinreichend konkretisierte Gefahr), in the sense that there be at least factual indications that a specific danger to the protected legal interests may emerge.
4. b) For extended use in the form of intelligence analysis, it must be necessary for investigating a specific action or group that warrants surveillance by intelligence services in the individual case; thus, it must at least be possible to determine the type of incident that might occur and that it will occur within a foreseeable timeframe.
5. c) For extended use for law enforcement purposes, a suspicion based on specific facts must exist in respect of which specific circumstances have taken shape that support the suspicion.
6. § 6a(2) first sentence ATDG does not satisfy these requirements. It is true that the provision only authorises extended use for the protection of especially weighty legal interests. However, the powers under § 6a(2) first sentence ATDG lack a sufficiently qualified threshold. Pursuant to this provision, it is sufficient that the investigation of “further facts of the individual case” be “necessary in the individual case”. § 6a(2) ATDG does not clearly set out that a specific suspicion that has taken shape and is supported by facts – in contradistinction to an initial suspicion under the Code of Criminal Procedure – is necessary in respect of extended use for law enforcement purposes. Tying such powers to a project within the meaning of § 6a(4) ATDG does not remedy the constitutional deficiencies of the prerequisites for interference laid down in § 6a(2) first sentence ATDG, given that § 6a(4) ATDG does not set out a sufficient threshold either.
7. By contrast, § 6a(1) and (3) ATDG are compatible with the Constitution. Sufficiently clear thresholds can be derived from these provisions by way of interpretation; they satisfy the constitutional requirements. However, § 6a(3) first sentence ATDG must not be understood as authorising extended use for mere preliminary or background investigations not related to at least an identifiable danger. Such an interpretation of § 6a(3) first sentence ATDG would be unconstitutional.
8. The requirements pertaining to individual legal protection and administrative oversight as set out in § 6a(7) and (8) ATDG are also compatible with the principle of proportionality.

Image credit: Mehr Demokratie, published under a CC BY-SA 2.0 licence.