Federal Criminal Police Office Act (BKA Act)
The BKA Act provides for far-reaching surveillance powers and hence violates fundamental rights. Our constitutional complaint was successful - several powers were declared unconstitutional.
The GFF has filed a constitutional complaint in Karlsruhe against the Federal Criminal Police Office Act (BKA Act) in its version of 1 June 2017. Various provisions of the BKA Act violate the fundamental right to informational self-determination as well as the right to a guarantee of the confidentiality and integrity of information technology systems, also called the IT privacy right.
Suspects' contacts can be monitored
The BKA Act empowers the Federal Criminal Police Office to employ a range of surveillance measures. In particular, far-reaching means of covert surveillance are available for counter-terrorism, such as wiretapping or the use of undercover investigators. As early as 2016, the Federal Constitutional Court ruled in its decision on the old BKA Act that these means may only be used under certain constitutionally defined requirements. The Federal Constitutional Court therefore ordered the legislature to improve the BKA Act and to ensure that the encroachments on fundamental rights contained therein are always in proportion to their goal, the defence against terrorism.
This is however not the case in the new version of the BKA Act of 2017. People who have only had contact to a suspect can still become the target of surveillance measures. This also affects two of the complainants in the constitutional complaint, who are in contact with suspects through their professional activities as lawyers. The surveillance measures available to the BKA in such a case affect the core area of a person's private sphere.
In its ruling of October 1, 2024, the Federal Constitutional Court declared that a specific individual proximity to the potential crime must be established for secret surveillance measures against mere contact persons. The requirements for surveillance were too vague and broad in this case and violate the right to privacy and informational self-determination.
State trojan jeopardises IT security
In addition, since 2017, the BKA Act - like many police laws - contains powers to use so-called state trojans. The BKA can carry out online searches and analyse ongoing communications (source tapping) to counter terrorism. For this purpose, the BKA is allowed to install state spying software on the computers of suspects and to exploit security vulnerabilities in hardware and software that are unknown to the manufacturers. This way of dealing with IT security vulnerabilities threatens the IT security of all citizens, when in fact the government should be protecting it. The state trojan therefore violates the so-called IT privacy right, which guarantees the confidentiality and integrity of information technology systems.
Update: In light of the Federal Constitutional Court's decision on our constitutional complaint against the Baden-Württemberg Police Act, we have withdrawn our complaint about the state trojan. Therefore the government spying software will no longer be part of the oral hearing on 20 December 2023. Here, the Federal Constitutional Court required us to make more submissions, which we were unable to do either in those proceedings or in the present proceedings against the BKA Act - but we were able to do so in our proceedings against the G10.
BKA data collection needs specific boundaries
Finally, the constitutional complaint aims to regulate the BKA's data files in conformity with the constitution. In this respect, the constitutional complaint breaks new ground, since specific constitutional standards for the collection and storage of data by the BKA are still lacking. Sensitive personal data can already be stored on a large scale on the basis of vague indications, sometimes even on the basis of mere suspicions, and used without further factual and temporal limits. As a result, comprehensive personality profiles of people who have never done anything wrong can be created and remain stored permanently.
The BKA's data collection extends to considerable groups of the population and creates the risk for the individuals concerned to become victims of discriminatory interrogations up to measures depriving them of their liberty. With regard to the BKA's data collections, the constitutional complaint submits a proposal for specifying the necessary constitutional standards.
At least as far as the requirements for the inclusion of suspects in the INPOL database are concerned, the Federal Constitutional Court declared the corresponding regulation to be incompatible with the right to informational self-determination. The precautionary storage in INPOL requires a certain materiality threshold and an individual negative prognosis as a relevant interference with fundamental rights.
Numerous violations of fundamental rights
Comprehensive surveillance authorisations, state trojans, uncontrolled data collection - the BKA Act contains a number of unconstitutional encroachments on fundamental rights. The five complainants of the constitutional complaint are particularly likely to be affected by this due to their professional or other activities, but ultimately all citizens can be targeted by the BKA through no fault of their own. With our constitutional complaint, we want to ensure that these abuses are remedied and that the Federal Constitutional Court creates specific standards for the retention and use of data by the BKA.
BKA Act on review
In December 2023, the Federal Constitutional Court heard our constitutional complaint against the BKA Act.
During the hearing, it became very clear from the First Senate's questions and the Federal Government's answers that the challenged powers to monitor contact persons are formulated too broadly and are not clearly regulated. Constitutional court judge Ines Härtel emphasised that a particularly intrusive standard - such as that for secret surveillance - is also subject to special requirements regarding the clarity of the standard.
With regard to the databases, the first issue was the BKA's own database, which it maintains for its counter-terrorism responsibilities. Our constitutional complaint criticises the fact that the relevant, very abstract regulation does not sufficiently differentiate between the different levels of data storage, use and processing. The Federal Data Protection Commissioner also expressed serious doubts in this regard. The Federal Government was unable to dispel these doubts.
The hearing also dealt with the information network used jointly by the federal and state governments – a database which can be accessed by police authorities throughout Germany. It became clear from the court's questions and the government's answers that there is no very clear control programme before data is entered into the database. In particular, it also became clear that it is not always checked whether a person is really dangerous before they are entered into the database.
