Census 2021

Jointly with the Census Working Group, the GFF has filed a constitutional complaint against the mass transmission of registration data as part of a test run for the 2021 census. Never before have such extensive data records been made accessible in a central database. Such an extensive collection of registration data is not necessary in order to carry out a test run. Moreover, it is dangerous.

The constitutional complaint is directed against the Amending Act to the Census Preparation Act 2021. This law, which was passed by the Bundestag in a fast-track procedure, provided for a large-scale test run for the 2021 census in which the registration data of all citizens was made available to the Federal Statistical Office within four weeks of January 13, 2019. The test run was intended to validate the method of transmission and the quality of the data. It was completely unnecessary, however, in this extremely broad form. In fact, the test run creates through the back door an unprecedentedly extensive database of all citizens.

Centrally stored data – a potential target for hacker attacks

As part of the test run, an entire catalogue of data, some of it extremely sensitive, for example information such as name, gender identity, marital status or religious affiliation, was transmitted. The data was not anonymized or pseudonymized. With the help of so-called order characteristics, relationships between individual persons can be inferred and deduced. This data was transmitted by the registration offices to the statistical offices of the Länder and can be called up centrally by the Federal Statistical Office.

This is the first time that such extensive data records of all citizens have been brought together in one central location – an attractive target for criminal hackers and a massive violation of data protection principles. According to information available to the GFF, the data is not held by the Federal Statistical Office itself, but by a third party whose reliability is unclear.

Violation of fundamental right of data protection

The GFF regards this approach as a violation of the “fundamental right to data protection”, i.e. the right to informational self-determination. This right was established by the Federal Constitutional Court in its 1983 census judgment. The court set clear limits for the government with respect to the collection and utilization of the data of its citizens.

The registration data collected by the government may only be used for absolutely necessary purposes, including to conduct censuses. The test run envisaged clearly exceeds this limit. The purpose of testing software for the 2021 census is disproportionate to the risk of personal data being misused by third parties.

In particular, data should be anonymized as far as possible. This would have been perfectly sufficient for purposes of the current test. Instead of transmitting the actual registration data of up to 82 million individuals, the authorities could have used fictitious data to test the transmission of a large volume of data. Moreover, a small sample of the real data would have sufficed to test the quality of the data.

Failure to recognize urgent need for action

In order to halt the test at short notice, the GFF applied for interim measures with the Federal Constitutional Court in January 2019. The Federal Constitutional Court rejected the GFF’s urgent application at the beginning of February and thus failed to recognize the urgent need for action to ensure the protection of the data. The Court conceded that the requirement to anonymize real data that is transmitted and stored lacks legal clarification. Nevertheless, after weighing the consequences, the Federal Constitutional Court refused to stop the test run.

However, in its decision on the emergency appeal, the Federal Constitutional Court expressed clear doubts as to the necessity of the test run. The Court found that a constitutional complaint against the Census Preparation Act 2021 was not manifestly outside its purview or unfounded.

Constitutional complaint unsuccessful

On 20 January 2022, the Federal Constitutional Court decided not to accept our constitutional complaint for decision. It based this decision solely on a procedural question: namely, whether it would have been necessary to first bring the case to the administrative courts. The Federal Constitutional Court answered in the affirmative, from our point of view wrongly: The administrative courts could not have done more than to pass the legal dispute through the instances; thus the matter would have ended up before the Federal Constitutional Court again, with many years of delay and with considerable costs on our side, without the latter having found a better basis for its decision. The court did not comment on the actual legal question - the necessity of transmitting the real data.

GFF against government data collection

The aim of the constitutional complaint is to reduce the unnecessary risk of third parties gaining access to the real data of citizens. The registration data already collected for the test run is to remain stored centrally for up to two years. In addition, we want to prevent comparable test runs in the future.

The GFF defends fundamental human rights, in particular against governmental interference. Not only would the planned central database be a potential target for hacker attacks, there is the further danger that, in addition to the Federal Statistical Office, other authorities may want to claim an interest in gaining access to this data. This step towards a surveillance state must therefore be prevented from the outset.