cations relating to the core of private life will in all likelihood be intercepted, no specific
provisions are required that are aimed at removing selectors relating to the core of
private life prior to data collection. This does not alter the fact that, insofar as it can
be ascertained that the use of search terms will in all likelihood result in the interception of communications relating to the core of private life, such communications must,
where possible, be technically excluded from interception prior to data collection (cf.
BVerfGE 141, 220 <306 and 307 para. 218 et seq.>).
At the stage of manual data screening, the law must ensure that further screening
ceases as soon as it becomes ascertainable that surveillance is encroaching on the
core of private life; even where mere doubts arise, the measure may only be continued – subject to exemptions for cases of urgency (cf. BVerfGE 141, 220 <280 para.
129>) – in the form of recordings that are examined by an independent body prior to
analysis (cf. BVerfGE 141, 220 <279 and 280 para. 129>; see also § 3a second to
eleventh sentence of the Article 10 Act). It must be ensured that intelligence from the
highly personal domain must not be used and must be deleted immediately; this must
be documented and the deletion logs must be retained for a sufficiently long period
so as to allow for oversight under data protection law (cf. BVerfGE 141, 220 <280
para. 129>; see also para. 289 et seq. below).
207
j) The principle of proportionality also gives rise to deletion obligations with regard
to surveillance measures. The purpose of these obligations is to ensure that the use
of personal data remains limited to the purposes justifying the data processing, and
that data can no longer be used once these purposes have been achieved (cf. BVerfGE 65, 1 <46>; 133, 277 <366 para. 206>; 141, 220 <285 and 286 para. 144>; established case-law).
208
Surveillance measures such as those in question here, which intercept large volumes of data only part of which may be accessed for analysis, must be subject to
clear provisions on deletion; these provisions must ensure that data that was unintentionally intercepted, but for which screening of its contents is impermissible under
constitutional law, is immediately separated from the other data and is permanently
deleted without any trace. Insofar as data analysis is carried out in several steps in
which the volume of data is progressively reduced, specific provisions are required to
ensure that data is swiftly analysed and that, at every stage, data identified for deletion is deleted immediately (cf. BVerfGE 100, 313 <385; 400>). Insofar as information
is categorised as relevant and is to be stored for a longer period to allow for further
use, corresponding provisions must be enacted. The legislator must create duties to
monitor data storage at sufficiently short intervals (cf., e.g., § 6(1) of the Article 10
Act; BVerfGE 100, 313 <400>) to ensure that data is not kept without justification.
209
The key steps of the data deletion process must be documented, insofar as this is
practical and necessary for independent oversight; the deletion logs must be retained
for a sufficiently long period to allow for effective oversight (cf. BVerfGE 141, 220
<302 and 303 para. 205>; see also para. 291 below).
210
55/87