the data to be stored cannot reasonably be demanded. Which aspects may be significant for investigations in the individual case is closely related to the authorities’ level
of knowledge, may change at short notice because of unforeseen events, and may
then require rapid updating. Thus the final limitation of the relevant criteria is possible only on the basis of specific specialised understanding and current assessments.
Under these circumstances, it is not objectionable from the viewpoint of specificity if
the legislature provides an open-ended description of the data to be stored which is
still in need of practical specification, and if the legislature prescribes a tiered procedure for their specification while using them, a procedure in which the information
actually to be entered into the database is further specified and limited according to
professional expertise. Such a specification, even if it includes abstract and general
determinations that are of considerable importance, is not a task that is necessarily
incumbent upon the legislature itself. Rather, in a state with a separation of powers, it
may without constitutional objections be entrusted to the executive. The defining factor is that in the present case, the legislature has not granted a blanket authorisation
to the authorities, but has described the criteria in such a way that those criteria can
be defined further. The aspects and focus of the data to be stored are legislated in
their content, and supported with examples and assessment criteria, in such a way
that they are meaningful as a foundation for a further specification by the executive,
and contain clear guidelines and limits for that purpose. Here again one must keep
in mind that this concerns only the specification of the scope of those data that are
already held by the entering authorities, that are to be included in the database, and
that concern persons who could be viewed as possibly affiliated with terrorism; the
group of those persons must be described with sufficient limitations by the legislature
itself (see D. IV. 2. above).
(2) To compensate for the open-endedness and need for further specification of
these provisions, the legislature must ensure that the specification and standardisation that will ultimately govern the application of the provisions in an individual case
are comprehensibly documented and published by the security agencies.
183
[…] Such a definition, documentation and disclosure serves, first of all, to circumscribe the authority granted to the executive by forestalling an overreaching or abusive application of the provision (cf. Constitutional Court of the Free State of Saxony,
Verfassungsgerichtshof des Freistaates Sachsen – SächsVerfGH, [judgment of 10
July 2003 – Vf. 43-II-00 –, juris,] para. 198). Second, it ensures an adequate level of
supervision. The documentation and disclosure of the criteria defined by the executive will in particular enable the Data Privacy Commissioners to monitor whether the
application of the provisions by the executive, which the legislature conceived to
evolve in stages, follows rational criteria and is guided by the intent and purpose of
the law.
184
The current legal status does not fully meet these requirements […].
185-186
[…] If the legislature intends to adhere to the vague terms of law in § 3 sec. 1 no. 1b
37/45
187