Germany

[DE] Telecommunications Law Disclosure Obligations Partly Unconstitutional

IRIS 2012-4:1/14

Sebastian Schweda

Institute of European Media Law (EMR), Saarbrücken/Brussels

The Bundesverfassungsgericht (Federal Constitutional Court - BVerfG) has partially upheld a complaint about storage and disclosure obligations laid down in telecommunications law.

The complainants had mainly argued that Articles 111-113 of the Telekommunikationsgesetz (Telecommunications Act - TKG) infringed their basic rights.

Article 111 TKG requires telecommunications service providers to store certain data concerning the connections they provide and the owners of those connections. The BVerfG considered this requirement to be justified on the grounds that it enabled the State authorities to carry out their tasks, in particular in the field of criminal prosecution, security and intelligence-related activities. As the stored data only contained a limited amount of information, the intrusion was not particularly serious. In particular, apart from the storage of traffic and location data, it did not contain any information about the actual activities of individuals.

According to Article 112 TKG, the Bundesnetzagentur (Federal Networks Agency - BNetzA), as the national regulatory body for telecommunications, can access the data stored under Article 111 TKG by means of the so-called automated retrieval procedure directly and without the knowledge of the company that stored it. Approved authorities can obtain this data from the BNetzA on the basis of legislative provisions under which data collection is permitted. The BVerfG also considered this “double door” procedure as proportionate, since it enabled the State to carry out its duty to guarantee security. To this end, it needed to be able to allocate telecommunications numbers to individuals. In principle, this also applied to static IP addresses, since these were currently, as a rule, only assigned to major clients. However, the legislator should monitor this and, if necessary, improve the regulations. Dynamic IP addresses, on the other hand, are, according to the ruling, excluded from the storage requirement of Article 111 TKG and the information retrieval procedure provided for in Article 112 TKG.

Telecommunications companies are also obliged, under the so-called manual information procedure described in Article 113(1) sentence 1 TKG, to provide information on data collected under Article 111 TKG and other user-related data stored under Article 95 TKG as part of consumer contracts. The BVerfG also deemed these provisions compatible with the Grundgesetz (Basic Law); however, they needed to be interpreted in accordance with the Constitution: on the one hand, the rule should not yet be considered, in itself, as an obligation to provide information. Rather, for both “competence-related and constitutional reasons”, it was necessary to create independent sectoral provisions that clearly regulated which authorities were entitled to the information. Such clear rules were not currently in place, particularly with regard to requests for information about the allocation of dynamic IP addresses, which were usually based on Article 113 TKG. However, such disclosure was not allowed under Article 113(1) sentence 1 TKG because the resulting violation of telecommunications privacy fell under the “Zitiergebot”, i.e., the rule according to which the basic right affected must be specified in the legislative text. This was not the case here.

However, the BVerfG considered further obligations under Article 113(1) sentence 2 TKG concerning information on PINs and PUKs used to protect access to mobile communications devices and the data stored on them to be disproportionate. Such access was not required for the authorities to carry out their tasks effectively. Rather, it should be governed by independent sectoral provisions regulating which authorities were entitled to the information and how the data could be used. Data-use restrictions were not provided under current regulations. The court granted the legislator a transitional period lasting until 30 June 2013, during which Article 113(1) sentence 2 TKG could continue to be applied, as long as the conditions for data use were met in each individual case.