5. The Land North Rhine-Westphalia is ordered to reimburse the complainants three quarters of their necessary expenses.
Reasons:
A.
The subject-matter of the constitutional complaints are the provisions of the North
Rhine-Westphalia Constitution Protection Act regulating, firstly, the powers of the
constitution protection authority regarding various instances of data collection, in particular from information technology systems, and secondly, the handling of the data
collected.
1
I.
The impugned provisions were largely inserted or amended by the Act Amending
the Act on the Protection of the Constitution in North Rhine-Westphalia of 20 December 2006 (Law and Ordinance Gazette of North Rhine-Westphalia, p. 620).
2
1. Both constitutional complaints complain of the unconstitutionality of § 5.2 no. 11
of the North Rhine-Westphalia Constitution Protection Act. This provision empowers
the constitution protection authority to carry out two types of investigative measures:
Firstly, secret monitoring and other reconnaissance of the Internet (alternative 1), and
secondly secret access to information technology systems (alternative 2).
3
a) The Internet is an electronic combination of computer networks. It hence consists
of information technology systems, and can itself also be regarded as an information
technology system. The difference between the two types of measure regulated in §
5.2 no. 11 of the North Rhine-Westphalia Constitution Protection Act relates to the external appearance of technical access to the information technology system. Secret
reconnaissance of the Internet is understood to be a measure by which the constitution protection authority obtains knowledge of contents of Internet communication using the channel technically provided therefor. The Government of the Land North
Rhine-Westphalia speaks of server-orientated Internet reconnaissance when referring to such measures.
4
Secret access to an information technology system is understood by contrast to be
technical infiltration which for instance takes advantage of the security loopholes of
the target system, or which is effected by installing a spy program. The infiltration of
the target system makes it possible to monitor its use or to view the storage media, or
indeed to control the target system remotely. The Government of the Land North
Rhine-Westphalia refers to such measures as client-orientated reconnaissance of the
Internet. However, the impugned provision does not contain an indication that it is exclusively orientated towards the server-client model in order to facilitate measures in
the framework of a network structure.
5
4/60