German security officials are now able to pull up personal data of internet and cell phone users with a couple of clicks. A new piece of legislation provides for this expanded access, which is drawing criticism.
You get a parking ticket, and suddenly the police can get hold of your cell phone number and bank account data? Or you criticize German intelligence authorities in an online forum, and then they are permitted to monitor your mail and telephone communication? These are the scenarios feared by critics of a new telecommunications law going into effect Monday (01.07.2013) in Germany.
The law establishes new regulations on how security agencies and intelligence authorities deal with so-called inventory data. While investigators from such offices view the law as desperately needed, privacy advocates say it goes too far and could be unconstitutional. Opponents fear that it will allow German intelligence agencies to collect private data on a large scale and without sufficient reason.
In the law, inventory data refers to the bits of information that belong to every telephone or internet connection, such as a person’s name, address, birthday and account number along with passwords or PIN and PUK numbers. IP addresses, which serve as a kind of digital finger print for individual internet users, also count as inventory data.
According to the new law, security officials including the federal police, the Federal Office for the Protection of the Constitution, customs officials and the German Federal Intelligence Service (BND) would be allowed to access a person’s data provided that person is believed to have committed a misdemeanor or criminal offense. Prior to the law going into effect, such data could only be accessed in cases of severe criminal offenses.
The lowered threshold for accessing data is why privacy advocates fear that, in extreme cases, even very minor infractions like using the wrong parking spot could fall under the law’s scope.
Rainer Wendt, chairman of the German Police Union (DPolG), disagrees, telling DW: “This instrument will not be used to catch parking violators or people who crossed a street while the light was red. This instrument will only be used in cases involving offenses with severe consequences.”
Opposing that view are voices including that of Germany’s Federal Commissioner for Data Protection and Freedom of Information, Peter Schaar and the German Federation of Journalists as well as political parties like the Greens, the Left and the Pirate Party. The Pirate Party’s political chairperson, Katharina Nocun, has called for a higher bar when it comes to authorities being allowed to identify an internet user.
“In an era in which more and more political communication takes place online, that is simply a very clear violation of basic rights,” she said, adding that the law is structured in a way that allows for a wide range of data collection, even after minor legal infractions. This would give significant insight into a person’s private life.
Nocun also believes that passwords should not be in the scope of the law at all, because that information could too easily be abused.
Judges must approve password distribution
But not all inventory data will be accessible after a couple of mouse clicks for German authorities. If passwords or a PIN are sought, then investigators need the approval of a judge. Privacy advocates’ objection here is that judges generally don’t take their time to examine such requests thoroughly. In a 2003 report from the Max Planck Institute for Foreign and International Criminal Law, judges decisions in such cases were characterized as follows: “Rejections almost never occur or only a neglectable number of times.”
The new law stipulates that people will be informed after the fact when an agency has received their password or PIN with the approval of a judge. In the past, that was not the case. “Everyone can be sure that he or she will of course be notified as per the law when such data are accessed,” noted Wendt.
However, Katharina Nocun sees cause for concern in the fact that telecommunications providers can no longer take matters into their own hands when it comes to informing their clients about such data access. There’s a regulation preventing that. That’s why the law is dangerous, says Nocun: “A society in which I don’t at all know whether I’m being surveilled or not, whether I am perhaps being disadvantaged as a result, that I’ve perhaps said something negative about the government in an internet forum – that changes a democracy.”
A call for patience
The new law came after Germany’s Constitutional Court declared parts of a previous attempt at a new regulation on data access for unconstitutional in January 2012. At the time, judges criticized the lack of a legal basis for receiving data from telecom providers. However, the court said that handing over inventory data was fundamentally constitutional.
The new law going into effect July 1 was passed with approval from parties including the governing CDU and FDP, and the opposition SPD, all of whom regard the legislation as necessary. In May, Interior Minister Hans-Peter Friedrich described the incoming law as “an indispensable investigative instrument for agencies that go after criminality and prevent danger,” and cited as an example the search for missing individuals, who could be located using cell phone GPS data.
Germany’s Constitutional Court, the country’s highest legal institution, will still have to determine whether the new draft is constitutional. Katharina Nocun and her Pirate Party colleague Patrick Breyer along with fellow supporters are already planning to challenge the legislation in court. Nocun says that so far, a high four-digit number of individuals have extended their support to the legal petition.
“Basically, the law is in clear violation of the constitution on six points,” Nocun believes.
Rainer Wendt says he also realizes that the new draft may not square completely with the German constitution.
“Legally speaking – even if it doesn’t please some people – we are in a new area in need of development, where legislators and often lawyers, too, are on unfamiliar ground,” said the police union chair. He added that it would be a difficult task to formulate fundamental laws in a new way, addressing the area of telecommunications and the Internet.
As such, he calls on both critics and supporters of the inventory data law to offer a measured response to the legislation: “People should neither berate the lawmakers, who are sincerely trying to arrive at reasonable laws, nor the constitutional court, which is the ultimate authority on ensuring that the fundamentals of our constitution are being upheld in the era of modern information technology.”