addition to requiring an individual handling of cases, that provision’s section 3 also
requires periodic reviews of the deletion requirements.
Regarding electronic profile searching measures, § 20j sec. 3 BKAG sets out specific deletion requirements which the provision specifies in a manner that does not raise
constitutional objections.
271
b) In contrast, however, the very brief safekeeping period for the deletion of the
“files” in § 20v sec. 6 sentence 3 BKAG, with which the Act governs the deletion of the
deletion protocols, is not compatible with constitutional requirements. Deletion protocols serve the purpose of enabling the tracing back and review of the deletion. Thus,
the safekeeping period must be calculated so as to ensure that the logs still exist after
the persons concerned have been notified, and are still available for the next pending
periodic review by the Federal Data Protection Commissioner (cf. in this respect also
BVerfGE 100, 313 <400>).
272
The same applies accordingly to the safekeeping period set out in § 20j sec. 3 sentence 3 BKAG.
273
c) Furthermore, § 20v sec. 6 sentence 5 BKAG is unconstitutional. The provision
gives permission to refrain from deleting the data once it has served its purpose on
grounds that the data is needed for law enforcement purposes or – pursuant to the
standards set out in § 8 BKAG – for the prevention of crimes or as a precaution for the
future prosecution of a criminal offence of considerable significance. Thus the provision allows the storage of data with a view to using it for new purposes that are, however, only circumscribed in general terms; the Act does not provide a legal authorisation to that end for such generally circumscribed purposes and in fact could not
provide a legal authorisation in such broadness.
274
D.
Insofar as the constitutional complaints are directed against the powers to further
use the data and the powers to transfer data to domestic authorities and authorities in
third countries, the complaints are also well-founded in several respects.
275
I.
The requirements for the further use and transfer of data collected by the state follow the principles of purpose limitation and change in purpose (cf. BVerfGE 65, 1
<51, 62>; 100, 313 <360 and 361, 389 and 390>; 109, 279 <375 et seq.>; 110, 33
<73>; 120, 351 <368 and 369>; 125, 260 <333>; 130, 1 <33 and 34>; 133, 277
<372 et seq. paras. 225 and 226>; established case-law).
276
If the legislature also permits the use of data beyond the specific incident and beyond the reason justifying the data collection it must establish a distinct legal basis to
that end (cf. only BVerfGE 109, 279 <375 and 376>; 120, 351 <369>; 130, 1 <33>;
established case-law). Insofar, the legislature may, on the one hand, provide for a further use of the data in the context of the purposes determining the data collection.
277
45/71