Bundesverfassungsgericht - Decisions - Data retention unconstitutional in its present form
14.08.20, 10:44
of emotional or social need, completely or predominantly by telephone, to callers who normally remain
anonymous, where these organisations themselves or their staff are subject to other obligations of
confidentiality in this respect (see § 99.2 TKG).
3. In addition, precautionary storage of telecommunications traffic data without cause and the use of 239
these data are only proportionate if the legislature takes sufficient precautions to ensure the transparency
of the use of data and to guarantee effective legal protection and effective sanctions.
a) The requirements of the constitutionally unobjectionable use of data obtained by such storage include 240
requirements as to transparency. As far as possible, the use of the data must be open. Failing this, it is in
principle necessary for the persons affected to be informed, at least subsequently. If, exceptionally, even
this subsequent notification is not made, there must be a judicial decision with regard to the nonnotification.
aa) Precautionary storage without cause of all telecommunications traffic data for a period of six months 241
is such a serious encroachment inter alia because it can create a sense of being permanently monitored;
in an unforeseen manner, it permits a high degree of knowledge of private life, without the recourse to the
data being directly perceptible by or visible to the citizen. The individual does not know which state
authority knows what about him or her, but knows that the authorities may know a great deal about him or
her, including highly personal matters.
By effective provisions on transparency, the legislature must counteract the diffuse sense of threat which 242
may attach to data storage as a result of this. Provisions on information for the persons affected by the
collection or use of data are generally among the elementary instruments of constitutional data privacy
(see BVerfGE 100, 313 (361); 109, 279 (363-364)); 118, 168 (207-208)); 120, 351 (361-361)). In this
respect, strict requirements must be imposed on the use of the data pools resulting from precautionary
storage of telecommunications traffic data without cause, which are extensive and offer a variety of
information. On the one hand, these requirements must reduce a sense of threat, which arises from
ignorance as to the factual relevance of the data, must counteract speculations which create a sense of
insecurity, and must make it possible for those affected to address such measures in public discourse. On
the other hand, such requirements may also be derived from the precept of effective legal protection under
Article 10.1 GG in conjunction with Article 19.4 GG. Without knowledge, those affected may assert neither
unlawful official use of the data nor any rights to deletion, correction or legal redress (see BVerfGE 100,
313 (361); 109, 279 (363); 118, 168 (207-208)); 120, 351 (361)).
bb) The requirements for transparency include the principle that the collection and use of personal data 243
should be open. Use of the data without the knowledge of the person affected is constitutional only if
otherwise the purpose of the investigation served by the retrieval of data would be frustrated. The
legislature may in principle assume that this is the case for warding off danger and carrying out the duties
of the intelligence services. In contrast, in criminal prosecution there is also the possibility that data may
be collected and used openly (see § 33.3 and 33.4 StPO). In this connection, investigation measures are
sometimes also taken in other matters with the knowledge of and in the presence of the suspect (see for
example §§ 102, 103, 106 StPO). Accordingly, persons affected must as a general rule be notified before
the retrieval or transmission of their data. There may only be a provision for secret use of the data here if
such use is necessary and is ordered by a judge in the individual case.
Insofar as the use of the data is secret, the legislature must provide for a duty of information, at least 244
subsequently. This must guarantee that the persons to whom a request for data retrieval directly applied –
whether as suspects, as persons endangering public security, or as third parties – are in principle
informed, at least subsequently. The legislature may provide for exceptions in weighing the notification
against constitutionally protected legal interests of third parties. However, these must be restricted to what
is absolutely necessary (see BVerfGE 109, 279 (364)). It is conceivable that there may be exceptions to
the duties of notification in connection with the prosecution of criminal offences, for example where
knowledge of the encroachment upon the secrecy of telecommunications would result in it failing to
https://www.bundesverfassungsgericht.de/SharedDocs/Entscheidungen/EN/2010/03/rs20100302_1bvr025608en.html
Seite 30 von 53