On the other hand, limits to the transfer of data arise with regard to the use of the data by the receiving state if violations of human rights are to be feared. In any event,
the transfer of data to third countries is imperatively barred if violations of the fundamental rule-of-law principles are to be feared (cf. BVerfGE 108, 129 <136 and 137>).
Under no circumstances may the state be complicit in violations of human dignity (cf.
BVerfG, Order of the Second Senate of 15 December 2015 – 2 BvR 2735/14 – para.
62, with further references).
328
b) Accordingly, the transfer of data to third countries presupposes a restriction to
sufficiently weighty purposes for which the data may be transferred and used (aa), as
well as the ascertainment that the data will be handled in the third country in acceptable conformity with rule of law standards (bb). Apart from that, the guarantee of effective domestic oversight is required here, too (cc). The requirements are to be ensured through specific and clear foundations in German law (dd).
329
aa) As far as the requirements for the purpose of the transfer and use of the data are
concerned, the constitutional criteria for a change in purpose, being the relevant standards under the German legal order, apply (see above, D I 2). A transfer is thus permissible insofar as it would be permissible to collect the transferred data with comparably weighty means also for the purpose of the transfer (criterion of a hypothetical recollection of data). Thus, the transfer must pursue the aim of detecting comparably
weighty criminal offences or the protection of comparably weighty legal interests as
were relevant for the original data collection. As a rule, however, the transfer is not
subject to the requirement that there be a specific risk situation or suspicion of a criminal offence; it suffices that the transferred information or the request by the receiving
state show that there is, in the specific case, an evidentiary basis for further investigations for the purpose of detecting such criminal offences or protecting against impending dangers to such legal interests and threatening these at least in the medium
term. Insofar, the requirements for the transfer of data stemming from the surveillance of private homes and remote searches are stricter in that this requires that interference thresholds relevant for the data collection are fully complied with (see above,
D I 2 b bb; cf. also BVerfGE 109, 279 <377, 379>; 120, 274 <329 et seq.>).
330
With regard to the resulting necessity of appraising the use of data by the receiving
country, which is necessary in particular in the case of a transfer request by a third
country, sufficient weight must be attached to the autonomy of the respective other legal order. As far as the question of equal weight of the respective purpose of use is
concerned, it needs to be considered in this respect that the German legal order
faces another legal order whose parameters, categories and assessments are not
identical to those reflected in the German legal order and Basic Law and do not have
to be identical. The fact that purpose limitations of the German legal order are insofar
not identically reflected in the foreign legal order in the same detail does not bar a data transfer from the outset. When transferring the data, the receiving authorities must
be notified clearly and expressly of limitations of use.
331
58/71