courts, nor its own duties of subsequent notification, that go beyond the duties of notification under other provisions. It therefore omits important instruments for ensuring proportionality of the rules governing database use. In view of the purpose of the
counter-terrorism database, however, this is constitutionally justified. […]
c) Since transparency of data processing and enabling the protection of individual
rights can be ensured only to a very limited degree by the Counter-Terrorism Database Act, guaranteeing effective supervisory oversight is all the more significant.
Therefore, the principle of proportionality poses more rigorous requirements for the
effective design of this supervision both at the level of the law itself and in administrative practice.
214
aa) Guaranteeing effective supervision first of all necessitates supervisory authorities equipped with effective powers at both the federal and Land level, such as the
Data Privacy Commissioners under the current law. It is also necessary to keep full
records of accesses to and modifications of the data inventory. In this regard, technical and organisational measures must ensure that the data are available to the Data
Privacy Commissioners in such a way that they can be evaluated in a practicable
manner, and that the records include sufficient information to match them with the
process to be audited.
215
Given the nature of the counter-terrorism database as a joint database used both by
the federal and Land authorities, it must be ensured that uncertainties about areas of
federal responsibility do not cause the effective supervision of the database to take
second place to providing effective data transfer. […] It must likewise be ensured that
in the interaction among the various supervisory authorities, practicable and effective
supervision of the data obtained under the Article 10 Act – which are of particular importance in a database to which also the Federal Intelligence Service contributes a
significant amount of the content – is ensured. If the legislature provides for cooperation among security agencies in matters of information, it must also permit supervisory cooperation for the benefit of data privacy.
216
Since supervisory oversight has the function of compensating for the weak level of
the protection of individual rights, regular supervision is particularly significant, and
such supervision must be performed at reasonable intervals, the duration of which
must not exceed a certain maximum of approximately two years. This must be taken
into account in granting the associated powers.
217
bb) Guaranteeing compliance with the constitutional requirements for effective supervisory oversight is the joint responsibility of the legislature and the authorities.
218
[…]
219-220
d) […]
221
Since the storage and use of data under the Counter-Terrorism Database Act largely takes place hidden from the perception of the individuals concerned and the public,
222
42/45