course of the further information technology development for the constitution protection authority which technically can no longer be prevented, or only with disproportionate effort.
Further, the suitability of the regulated empowerment is also not to be denied simply
because the evidentiary value of the information obtained using access is possibly
limited. It is submitted in this respect that technical authentication of the collected data is in principle conditional on exclusive control of the target system at the time in
question (see Hansen/Pfitzmann, Deutsche Richterzeitung 2007, p. 225 (228)). However, these difficulties in securing evidence do not lead to a situation in which the collected data is devoid of value as information. What is more, according to the impugned provision, online access does not serve directly to obtain evidence for
criminal proceedings which will stand up to an appeal on points of law, but is to provide the constitution protection authority with knowledge on the reliability of which
less stringent requirements are to be placed due to the different nature of the task of
the constitution protection authority as regards prevention in the run-up to concrete
dangers than is the case in criminal proceedings.
223
cc) Secret access to information technology systems also does not violate the principle of necessity. In the context of its prerogative of assessment, the legislature may
presume that no path which is equally effective, but less burdensome for the person
concerned, exists to collect the data that is available on such systems.
224
In principle, an open search of the target system – not provided for in the Constitution Protection Act – is to be regarded as a less intrusive means in comparison with
secret access (see Hornung, Datenschutz und Datensicherheit 2007, p. 575 (580)).
If, however, the constitution protection authority has sufficient grounds to view the
files stored on the storage media of an information technology system comprehensively in the performance of its tasks – including encrypted data –, to follow changes
for a longer period or to comprehensively monitor the use of the system, it is not evident that there are less intrusive means to attain these investigation goals. The same
applies to access to encrypted contents of Internet communication insofar as access
to the transmission channel has no prospects of success.
225
dd) § 5.2 no. 11 sentence 1 alternative 2 of the North Rhine-Westphalia Constitution
Protection Act however does not comply with the principle of appropriateness in the
narrower sense.
226
This principle requires that the gravity of the encroachment, in an overall evaluation,
may not be disproportionate to the gravity of the reasons justifying it (see BVerfGE
90, 145 (173); 109, 279 (349 et seq.); 113, 348 (382); established case-law). The legislature must appropriately attribute the individual interest encroached on by an encroachment on fundamental rights to the general interests served by the encroachment. A review carried out according to these standards can lead to a situation in
which means may not be used to implement general interests because the impairments of fundamental rights emanating from it are more weighty than the interests to
227
38/60