Headnotes

to the Order of the Second Senate of 2 March 2006

2 BvR 2099/04

1. Telecommunications traffic data stored within the domain controlled by a communicating party after the transmission process has been completed is not protected by [the privacy of telecommunications under] Art. 10(1) of the Basic Law, but by the right to informational self-determination (Art. 2(1) in conjunction with Art. 1(1) of the Basic Law) and, as the case may be, by Art. 13(1) of the Basic Law.

2. §§ 94 et seq . and §§ 102 et seq . of the Code of Criminal Procedure satisfy the constitutional requirements, also with regard to the securing and seizing of data storage devices and the data stored on them. They meet the requirement, applicable in particular to [interferences with] the right to informational self-determination, that the legislator specify precisely, for each subject matter and in a manner that is recognisable for the affected persons, the purposes for which collected data may be used. This is ensured by the strict limitation of all measures to the purpose of the investigation (cf. BVerfGE 113, 29).

3. When accessing traffic data stored by a communicating party, it must be taken into account that this data merits greater protection. The assessment of proportionality must reflect the fact that this is data which, if it were accessed outside the sphere controlled by the affected person, would enjoy the special protection of telecommunications privacy, and which, if it is stored within the domain controlled by the affected person, is afforded supplementary protection by the right to informational self-determination.

FEDERAL CONSTITUTIONAL COURT

- 2 BvR 2099/04 -

IN THE NAME OF THE PEOPLE

In the proceedings
on the constitutional complaint of

the Federal Constitutional Court – Second Senate –

with the participation of Justices

Vice President Hassemer,

Broß,

Osterloh,

Di Fabio,

Mellinghoff,

Lübbe-Wolff,

Gerhardt,

Landau

held on the basis of the oral hearing of 23 November 2005:

JUDGMENT

1. The Orders of the Karlsruhe Regional Court of 28 January 2003 - 2 Qs 114/02 - and of 12 October 2004 - 2 Qs 114/02 - violate the complainant’s fundamental rights under Article 13(1) and (2) of the Basic Law and Article 2(1) of the Basic Law. They are reversed. […]

2. […]

REASONS:

A.

The complainant, who is a local court judge, lodged a constitutional complaint challenging an order for the search of her home based on suspected breach of official secrets [pursuant to § 353b of the Criminal Code]. The purpose of the search was to investigate telecommunications traffic data on the complainant’s personal computer and mobile phone, which was believed to contain evidence that the judge had liaised with a journalist.

I.

Searches of a suspect’s home or possessions are governed by § 102 of the Code of Criminal Procedure. […]

[…]

The substantive requirements for securing and seizing evidence, which are further specified if evidence is obtained in connection with a search, are set out in § 94 of the Code of Criminal Procedure.

[…]

II.

1. Since mid-July 2002, the local police in H., in cooperation with the Land Criminal Police Office (Landeskriminalamt ), the Federal Criminal Police Office (Bundeskriminalamt ), and a US police authority, had been investigating P. and E., who were suspected of planning an attack on a US facility in H. or on the city centre of H., based on information received from a witness.

All information concerning the investigations of P. and E. was widely shared [among the authorities involved]. […]

On 5 September 2002, in a search of the home of the two suspects, chemicals and components were found that could be used in pipe bombs, together with a picture of Osama Bin Laden and books relating to Islam and to the so-called Holy War. The suspects were taken into custody. E. was interrogated by police officers H. and N.

The investigation files were submitted to the complainant as the competent examining judge (Ermittlungsrichterin ) at the H. Local Court on the morning of 6 September 2002, together with applications for arrest warrants. At approximately 11:00 a.m., lawyer F., acting as P.’s defence counsel, called lawyer N., so that the latter would take on the defence of suspect E. Lawyer N. appeared, without prior notice, for the judicial interrogation of Ms E., which began around 12:00 noon; Ms E. had been brought before the complainant by police officers H. and N. The complainant issued arrest warrants for both suspects. The interrogation ended at about 12:30 p.m.

Between 1:30 and 2:30 p.m., K., a reporter for Spiegel magazine, called the office of lawyer N., who had not yet returned, to inquire about the investigation proceedings. Differing witness accounts exist as to whether a reporter from Focus magazine also phoned that law firm with the same request, and whether this call took place shortly afterwards or a few days later. Between 4:00 and 4:30 p.m. on the same day, journalists from the AP news agency and Bild newspaper contacted the press office of the Baden-Württemberg Criminal Police Office with similar inquiries; the police office did not release any information at that time. At 6:00 p.m., the Deutschlandfunk radio channel, citing Bild newspaper, reported on the investigation proceedings. From 6:15 p.m., the AP news agency – also citing Bild newspaper – reported on the matter as well, as did the n-tv television station.

2. The public prosecution office launched investigations into suspected breaches of official secrets (§ 353b(1) of the Criminal Code). After the public prosecution office learned that the complainant and reporter K. were personally acquainted, it directed the investigation against the complainant as a suspect. An examination of traffic data from the phone lines at the H. Local Court, which were used by the complainant and others, did not indicate any contacts with the reporter. Analyses of traffic data from the phone lines at the H. Police Headquarters, where the investigating police officers had their offices, and from the complainant’s private landline also did not reveal any evidence of contact. It was not possible to examine the complainant’s mobile phone traffic data because the data had been deleted in the meantime. Interrogations of staff at the court’s registries, of another judge at the H. Local Court, of the police officers who had brought E. to the courthouse, and of the secretary of lawyer N. yielded no results. All these persons – who were questioned as witnesses – denied having known or shared the leaked information, and were then ruled out as suspects. The complainant was not questioned.

3. a) Search warrants sought by the public prosecution office for the complainant’s home and office were denied by the Local Court on 2 December 2002. […]

b) Upon a complaint lodged by the public prosecution office, the Regional Court authorised – by way of the challenged order of 28 January 2003, i.e. nearly five months after the event – a search of the complainant’s home and office, and the seizure of her computer, of copies of the investigation files, and of the itemised mobile phone bill.

[…]

c) On 5 February 2003, the complainant’s private home and her office were searched. The aim of the search was to secure the itemised mobile phone bill, copies of the investigation files, and other data that could possibly indicate contacts with the journalist. The mobile phone was seized to conduct a memory data analysis. The analysis showed that there was no call data for the period during which the suspected criminal acts took place.

d) Following the searches, the complainant filed a complaint against the search order, which was ultimately heard by the courts as an application to reinstate the procedural status quo ante on the grounds that her right to be heard had been violated (Antrag auf Nachholung des rechtlichen Gehörs ). […]

e) By order of 8 August 2003, the Regional Court rejected a remedy against the search order. […]

4. The Third Chamber of the Second Senate of the Federal Constitutional Court reversed this order on 5 February 2004 - 2 BvR 1621/03 - […], finding a violation of the right to be heard (Art. 103(1) of the Basic Law), and remanded the matter to the Regional Court.

5. In the challenged order of 12 October 2004, the Regional Court refused to declare the search unlawful. […]

III.

With her constitutional complaint, the complainant claims a violation of her rights under Art. 13(1) and (2), Art. 2(1), Art. 3(1), Art. 10(1) and Art. 103(1) in conjunction with Art. 19(4) of the Basic Law. 

[…]

IV.

Statements on the constitutional complaint were submitted by the Federal Government, the Land Governments of Baden-Württemberg, Bavaria, Lower Saxony and North Rhine-Westphalia, the President of the Federal Court of Justice and the Public Prosecutor General (Generalbundesanwalt ). In addition, the Federal Criminal Police Office, the Federal Bar Association (Bundesrechtsanwaltskammer ), the German Lawyers Association (Deutscher Anwaltsverein ) and the Federal Data Protection Officer were heard on the constitutional complaint.

[…]

B.

The constitutional complaint is for the most part admissible.

I.

[…]

II.

Although the challenged search order has been rendered moot by its execution, the complainant continues to have a legal interest in bringing proceedings. In cases of serious interferences with fundamental rights – which especially includes state action that the Basic Law itself subjects to the requirement of prior judicial authorisation (Richtervorbehalt ) – affected persons continue to have a legal interest in bringing proceedings at least where the direct impact of an act of public authority is limited to such a short period that it would hardly be feasible, in the regular course of proceedings, to obtain a timely court decision. This is generally the case regarding searches of private homes (cf. BVerfGE 96, 27 <38 et seq .>; 104, 220 <233>).

C.

The challenged orders of the Regional Court of 28 January 2003 and 12 October 2004 violate the complainant’s fundamental rights under Art. 13(1) and Art. 2(1) of the Basic Law.

The complainant’s fundamental right under Art. 10(1) of the Basic Law is not affected (see I below); rather, the measures at issue must be measured against Art. 13(1) of the Basic Law (see III below) and Art. 2(1) of the Basic Law (see II below). In the context of search and seizure measures, the principle of proportionality must be observed (see IV below), which the Regional Court failed to do (see V below).

I.

The challenged orders do not violate the privacy of telecommunications protected under Art. 10(1) of the Basic Law.

1. The complainant not only objects to the search of her home as such, but also argues that the purpose of the search, i.e. the accessing of traffic data stored on her telecommunications devices, violates her right to the confidentiality of remote communication.

2. The privacy of correspondence, post and telecommunications ensures the free development of one’s personality by enabling individuals to conduct communication in private, concealed from the public, and thereby also protects human dignity (cf. BVerfGE 67, 157 <171>; 106, 28 <35>; 110, 33 <53> […]).

Art. 10 of the Basic Law protects private communication at a distance. The privacy of correspondence, post and telecommunications guarantees the confidentiality of individual communications where the communicating parties must rely on transmission by intermediaries because of the spatial distance between them, which makes the communication particularly vulnerable to interception by third parties, including state authorities. The privacy of correspondence, post and telecommunications is an integral part of the protection of the private sphere; it protects against unwanted collection of information, and guarantees privacy despite spatial distance […].

The privacy of telecommunications protects the non-physical transmission of information to individual recipients by way of telecommunications traffic (cf. BVerfGE 67, 157 <172>; 106, 28 <35 and 36>). Its aim is, to the greatest possible extent, to place participants in a position where they can communicate as if they were physically present.

This fundamental right is receptive to new developments, and encompasses not only the forms of telecommunications known at the time of drafting, but also new technologies (cf. BVerfGE 46, 120 <144>). Therefore, the scope of this fundamental right is not limited to the telecommunications services that were historically offered by the Deutsche Bundespost , but rather encompasses all transmissions of information by means of available telecommunications technologies. Neither the specific method of transmission (cable or wireless, analogue or digital) nor the form of expression (speech, images, sound, symbols or other data) have a bearing on its scope of protection (cf. BVerfGE 106, 28 <36>).

The privacy of telecommunications protects both the contents and the specific circumstances of telecommunications (see a below). However, where the communication is not part of an ongoing transmission, the contents and circumstances of the communication stored within the domain controlled by a communicating party are not protected by Art. 10(1) of the Basic Law (see b below).

a) The privacy of telecommunications primarily protects the confidentiality of the information that is exchanged, i.e. communication contents, against unauthorised access by third parties.

As a consequence of digitisation, any use of telecommunications leaves personal traces that can be stored and analysed. Accessing this data does affect the scope of protection of Art. 10 of the Basic Law, as this fundamental right also protects the confidentiality of the specific circumstances of communications (cf. BVerfGE 67, 157 <172>; 85, 386 <396>; 110, 33 <53>; 113, 348 <365>).

In particular, this protection extends to whether, when, and how often telecommunications traffic occurred or was attempted, between whom or between which devices. Otherwise, the fundamental rights protection would be incomplete given that traffic data has its own informative value. In the individual case, traffic data could allow substantial conclusions to be drawn about the communication behaviour and movement patterns of the affected persons. The frequency, duration and time of communication traffic provide insights into the nature and intensity of relationships and allow conclusions to be drawn about the communication contents (cf. in this respect BVerfGE 107, 299 <320>).

b) However, the communication traffic data stored within the domain controlled by one of the communicating parties after completion of the transmission process is not protected by Art. 10(1) of the Basic Law. Rather, it is protected by the right to informational self-determination (Art. 2(1) in conjunction with Art. 1(1) of the Basic Law) and, as the case may be, by Art. 13(1) of the Basic Law.

In this respect, the protection afforded by the privacy of telecommunications ends when the recipient has received the message and the transmission process has been completed […]. The specific risks of remote communication do not apply within the domain controlled by the recipient, given that at this point they can take their own precautions against unwanted data access.

Post and telecommunications enable private communication between persons who are not in the same location, and thereby add a new dimension to the private sphere […]. Yet they also entail a loss of privacy, because the communicating parties must rely on the particular technical features of a telecommunications medium, and must put their trust in the telecommunications intermediaries involved in the process. Thus, third parties can more easily gain access to the contents and circumstances of the transmitted message. Participants who communicate remotely via technical means and use communication channels provided by intermediaries cannot themselves ensure that their communication remains confidential.

Art. 10(1) of the Basic Law serves to compensate for the diminished privacy resulting from the use of technology, and to counteract the risks inherent in the transmission process, including the involvement of a third party (cf. BVerfGE 85, 386 <396>; 106, 28 <36>; 107, 299 <313>). Thus, protection of telecommunications privacy is tied to the use of a communication medium (cf. BVerfGE 100, 313 <363>; […]).

Once the recipient has received the message, it is no longer exposed to an increased risk of interception by third parties – including by the state – that arises from the fact that the communicating parties cannot fully control and monitor the transmission process. From that moment, the stored communication contents and traffic data are no different [in terms of vulnerability] from other data files originally created by the telecommunications users themselves.

While communicating parties do not dispose of technical means to prevent or even just influence the generation and storage of traffic data by telecommunications intermediaries, their level of influence changes once the data is within their own sphere of control. Firstly, it is generally not possible for third parties to gain undetected access to the stored data without the knowledge of the communicating party. This removes a key justification for the special need for protection in the context of telecommunications privacy. Secondly, the affected persons themselves have significant control over whether data is stored permanently on their devices.

It is true that, generally, electronically stored data cannot be permanently deleted merely by using the delete function on the respective device; according to the expert statements delivered at the oral hearing, permanent deletion can only be achieved by using special software, for example in the case of computer hard drives. However, regardless of the variables and details of whether digitally stored data can be effectively deleted, the fact remains that telecommunications users do have various options of processing and deleting data stored within their sphere of control – including, as a last resort, physical destruction of the data storage device. These options are not available to them during ongoing transmissions or when traffic data is stored by telecommunications intermediaries. Regarding devices within their control, telecommunications users can take a range of measures to protect themselves against third parties gaining access; this includes the use of passwords or other access codes, or – in the case of personal computers – the use of encryption programmes and special data deletion software. […]

In determining the scope of protection of Art. 10 of the Basic Law – especially in distinction to Art. 2(1) of the Basic Law – it is not decisive whether users can always reliably delete the traffic data stored within their sphere of control. Rather, the decisive factor is whether the situation is comparable to that of other data stored within the user’s private sphere, such as the personal phone directory created by the user on their device, or information stored on the hard drive of a computer. In that case, there are no longer any specific risks associated with a transmission process that are beyond the user’s control or influence.

The special protection of telecommunications privacy under Art. 10 of the Basic Law compensates for the loss of control over one’s private sphere that results from the use of technology as an inevitable consequence of relying on telecommunications systems operated by third parties; it establishes a particular barrier against the comparatively easy accessing of telecommunications data that the use of telecommunications technology permits. By contrast, the private sphere that individuals can control themselves is protected by other fundamental rights, especially by Art. 13(1) of the Basic Law and the right to informational self-determination (Art. 2(1) in conjunction with Art. 1(1) of the Basic Law).

c) The fundamental rights protection afforded [under Art. 10 of the Basic Law] does not always end when the transmission via telecommunications systems reaches the user device (cf. BVerfGE 106, 28 <37>). The confidentiality of telecommunications protected under Art. 10 of the Basic Law may also be jeopardised where third parties directly access the user device. Whether the protection afforded under Art. 10(1) of the Basic Law can be invoked in this respect must be determined by taking into account the purpose of the fundamental rights guarantee and the underlying specific risks (cf. BVerfGE 106, 28 <37>). Surveillance of ongoing telecommunications constitutes an interference with the privacy of telecommunications even if the content of the message is intercepted at the user device. Given that the transmission of telecommunications must be regarded as a uniform process, it is not feasible to draw a distinction based on purely technical categories (cf. BVerfGE 106, 28 <38>). Once the telecommunications process has been completed, however, the communication contents and circumstances now stored on the users’ devices are no longer exposed to the same specific risks that arise from the use of a telecommunications device as a communication medium.

II.

The challenged orders violate the complainant’s right to informational self-determination under Art. 2(1) of the Basic Law.

1. In the present case, the right to informational self-determination (Art. 2(1) in conjunction with Art. 1(1) of the Basic Law) does not stand back behind the fundamental right of Art. 13(1) of the Basic Law, which is also affected (see III below). Although Art. 13 of the Basic Law, as the more specific freedom, generally supersedes Art. 2(1) of the Basic Law (cf. BVerfGE 51, 97 <105>; […]), the general right of personality – including in its manifestation as a right to informational self-determination – is not supplanted where its scope of protection only partially overlaps with that of a specific freedom, nor in cases that touch on a separate domain of freedom that has evolved independently and with clearly defined characteristics […].

This is the case here. Where a search warrant for a home is issued for the purposes of securing data storage devices or mobile phones on which telecommunications traffic data is stored, the measure is not limited to intruding on the spatial boundaries of the private sphere. Rather, the interference takes on a different quality by touching on another fundamental rights dimension in that it is intended to reveal information about a communication. As this concerns a special dimension of protection under Art. 2(1) in conjunction with Art. 1(1) of the Basic Law, this means that, by way of exception, this fundamental right does not stand back behind Art. 13 of the Basic Law. This special dimension, which is informed by the distinct characteristics of traffic data and serves to protect the integrity of remote communication, is a manifestation of this fundamental right’s supplementary function as a right expanding the protection afforded under Art. 10 of the Basic Law.

2. In the context of modern data processing, the free development of one’s personality requires that the individual be protected against the unlimited collection, storage, use and sharing of their personal data. This protection is part of the fundamental right under Art. 2(1) in conjunction with Art. 1(1) of the Basic Law. In this regard, the fundamental right confers upon the individual the authority to, in principle, decide themselves on the disclosure and use of their personal data (cf. BVerfGE 65, 1 <43>).

This fundamental right serves to prevent a chilling effect that could arise and impair the exercise of other fundamental rights if individuals were no longer able to tell who knows what kind of personal information about them, at what time and on which occasion. This could greatly impede their freedom to make self-determined plans and decisions.

A deterrent effect on the exercise of fundamental rights stemming from the secret knowledge of third parties [regarding one’s personal data] must be avoided, not only in the interest of the affected individuals. Such a deterrent effect would also affect the common good because self-determination is a fundamental prerequisite for the functioning of a free and democratic society which relies on the agency and participation of its citizens (cf. BVerfGE 65, 1 <43>).

3. a) Where the protection of telecommunications traffic data is concerned, the right to the privacy of telecommunications and the right to informational self-determination are complementary. Within its scope of application, Art. 10 of the Basic Law contains a specific guarantee protecting telecommunications, which supersedes the general guarantee of the right to informational self-determination (cf. BVerfGE 67, 157 <171>; 100, 313 <358>; 107, 299 <312>; 110, 33 <53>; 113, 348 <365>). Yet to the extent that interferences with telecommunications privacy concern the obtaining of personal data, the requirements that the Federal Constitutional Court derived from Art. 2(1) in conjunction with Art. 1(1) of the Basic Law in its Census decision (cf. BVerfGE 65, 1 <44 et seq .>) can, in principle, largely be applied to the more specific guarantee under Art. 10(1) of the Basic Law, too (cf. BVerfGE 100, 313 <359>; 110, 33 <53>).

Where Art. 10 of the Basic Law does not apply, personal traffic data stored within the sphere of control of affected persons is protected by the right to informational self-determination under Art. 2(1) in conjunction with Art. 1(1) of the Basic Law. This reflects the fact that the telecommunications circumstances merit special protection, and upholds the confidentiality of remote communications even after the transmission process has been completed.

b) Traffic data constitutes personal data with potentially significant informative value; therefore, it requires protection under the right to informational self-determination (Art. 2(1) in conjunction with Art. 1(1) of the Basic Law).

The use of digital transmission devices means that telecommunications are no longer transitory in nature but leave permanent traces. Due to digitisation, a multitude of traffic data is not only collected by service providers, but also automatically accumulates on user devices; this data provides information on the lines used in telecommunications, the time and duration of the transmission, and, to some extent, even on the participants’ location, and it is regularly stored beyond the duration of the respective communication. The volume and informative value of accumulated traffic data allow the creation of an ever clearer profile of the communicating parties. In the context of telecommunications, the convergence of transmission channels, services, and devices leads to an increasingly concentrated flow of information. Telecommunications devices, especially mobile phones and personal computers, are increasingly used not only for personal conversations but also for everyday transactions, such as shopping or paying bills, for obtaining and disseminating information, and for using various services. More and more areas of life are shaped by modern means of communication. This increases not only the volume of generated traffic data, but also its informative value. This data increasingly allows more conclusions to be drawn about the nature and intensity of relationships, about interests, habits and preferences, and most notably, about the contents of a given communication; depending on the nature and scope of the accumulated data, the resulting conclusions may even amount to the creation of a personality profile.

4. The right to informational self-determination affords protection against the collection of one’s personal data in any form (cf. BVerfGE 65, 1 <43>; 67, 100 <143>). A search order that – as in the present case – is specifically and expressly issued for the purpose of securing data storage devices believed to hold traffic data interferes with the fundamental right under Art. 2(1) in conjunction with Art. 1(1) of the Basic Law (cf. BVerfGE 107, 299 <314> on Art. 10 of the Basic Law).

5. Restrictions of Art. 2(1) of the Basic Law require a statutory basis specifying their prerequisites and scope in a manner that is clear and recognisable for citizens in accordance with the principle of legal clarity deriving from the rule of law (cf. BVerfGE 113, 29 <50>). §§ 94 et seq . of the Code of Criminal Procedure, and especially §§ 102 et seq . of the Code of Criminal Procedure, satisfy the constitutional requirements (see a below); there is no need to subject interferences to further limitations, as proportionality considerations in particular do not merit a stricter standard (see b below).

a) In its case-law, the Court has already decided that §§ 94 et seq . of the Code of Criminal Procedure satisfy the constitutional requirements, also with regard to the securing and seizing of data storage devices and the data stored on them (cf. BVerfGE 113, 29 <50>). The provisions satisfy the requirement, applicable in particular with regard to the right to informational self-determination, that the legislator specify precisely, for each subject matter and in a manner that is recognisable for the affected persons, the purposes for which the data may be used. This requirement is satisfied by the strict limitation of all measures to the purpose of the investigation – especially solving the criminal case under investigation (cf. BVerfGE 113, 29 <51>).

The same applies to §§ 102 et seq . of the Code of Criminal Procedure, which authorise search measures and specify further conditions in this regard. As § 94 of the Code of Criminal Procedure in principle allows for the securing and seizing of data storage devices or the copying of the relevant data, it is also permissible to order and carry out the search measures necessary in this regard.

b) Despite the fact that traffic data stored on a personal user device merits special protection and that Art. 2(1) of the Basic Law supplements Art. 10 of the Basic Law in that respect, the principle of proportionality does not require any further limitations on interferences beyond the requirements set out in §§ 94 et seq . and §§ 102 et seq . of the Code of Criminal Procedure. In particular, collecting traffic data stored on the user device of the person concerned is not subject to the requirements that would usually apply under § 100g of the Code of Criminal Procedure, i.e. it does not require that the investigation concern considerable criminal acts ([…]; BVerfGE 103, 21 <33 and 34>; […]) or criminal offences included in the catalogue laid down in § 100a first sentence of the Code of Criminal Procedure.

aa) The principle of proportionality requires that the measure in question serve a purpose that is legitimate under constitutional law, and be suitable, necessary and proportionate, in the strict sense, for achieving that purpose. The interference must not impose an excessive burden on the affected person, i.e. it must be reasonable (zumutbar ) (cf. BVerfGE 63, 131 <144>).

bb) Effective law enforcement is a legitimate purpose with regard to restrictions of the right to informational self-determination. Safeguarding the peaceful legal order (Rechtsfrieden ) by means of criminal law has always been an important responsibility of the state. The essential functions of the criminal justice system include investigating criminal acts, identifying offenders and deciding on their culpability and punishment, and exonerating the innocent. The criminal justice system thus serves to protect citizens by enforcing the state’s power to punish crime in judicial proceedings that are based on uniform standards, satisfy the rule of law and seek to establish the truth. Enacting provisions that impose criminal punishment and applying them in proceedings conducted in accordance with the rule of law are constitutional responsibilities (cf. BVerfGE 107, 104 <118 and 119> with further references). Therefore, the Basic Law accords great importance to the prevention and investigation of criminal acts (cf. BVerfGE 100, 313 <388>).

cc) §§ 94 et seq . and §§ 102 et seq . of the Code of Criminal Procedure allow for the accessing of traffic data stored within the domain controlled by the affected person; this is not only a suitable and necessary, but also an appropriate means for achieving this purpose. In particular, neither the fact that traffic data merits special protection nor the fact that Art. 2(1) of the Basic Law supplements Art. 10 of the Basic Law in that regard requires that the afforded level of protection limit interferences with the right to informational self-determination to the prosecution of considerable criminal acts.

(1) On the one hand, it must be taken into account in the balancing of the conflicting interests that traffic data merits special protection due to its informative value. In the individual case, such data allows significant conclusions to be drawn regarding communication behaviour and movement patterns. The frequency, duration and time of communication traffic provide insights into the nature and intensity of relationships; depending on the accuracy, quantity and variety of the generated data sets, this may amount to the creation of a personality profile in extreme cases, and even allow conclusions to be drawn about the contents of the communication (cf. in this regard BVerfGE 107, 299 <320>, see also C I 2 a and C II 3 b above). The weight of the interference increases further if the measure also affects the right to informational self-determination of the suspect’s communication partners who are not themselves involved in the crime under investigation.

On the other hand, it must be taken into account that the increased use of electronic or digital means of communication and their advance into virtually all areas of life has also created new obstacles to law enforcement. Modern communication technologies are increasingly used for committing a wide variety of criminal acts, rendering criminal activities more effective […].

The necessity that law enforcement keep pace with technological advances goes beyond making a mere practical addition to the traditional arsenal of investigation methods at the disposal of authorities, based on the belief that the existing methods would still be largely effective on their own. Rather, it must be acknowledged that there has been a shift from traditional forms of communication towards electronic communication, which also entails subsequent digital processing and storage of the relevant data.

Given these circumstances, the principle of proportionality does not require that the seizure of traffic data stored on a personal user device be generally limited to the investigation of considerable criminal acts. Such a limitation would result in inappropriate impairments of law enforcement. At the oral hearing and in the written statements, experienced experts familiar with the realities of criminal investigations stated convincingly that there is a great need for the accessing of traffic data stored on user devices even in cases where, based on the applicable range of punishment for the relevant offence, the criminal acts under investigation cannot necessarily be qualified as considerable crime. In this regard, the experts specifically cited as examples the dissemination of pornographic materials, including pornography depicting violence or animal pornography (§ 184 and § 184a of the Criminal Code), certain immigration offences (§ 95 of the Residence Act) and white-collar crime.

(2) In the context of assessing the proportionality of individual measures aimed at obtaining traffic data stored by a telecommunications intermediary, the Federal Constitutional Court held that it was necessary to limit such measures to investigations concerning considerable criminal offences (cf. BVerfGE 107, 299 <321>); yet this finding cannot automatically be applied to the traffic data stored on personal devices, as this data access takes place under different circumstances.

As far as data access is concerned, the measures under review here constitute less intense interferences. This follows from the fact that the data is accessed overtly, rather than covertly; that it does not entail the creation of movement profiles; that it is not necessary to obtain data from third parties – e.g., the telecommunications company – ; and that the affected persons have control over the data stored on their devices.

From the perspective of the communicating parties, the accessing of traffic data stored within the sphere of the affected person is not a covert measure, and thus lacks an essential element that is characteristic for interferences with the privacy of telecommunications; while covertness is not a necessary prerequisite regarding the protection afforded under Art. 10 of the Basic Law, it does significantly increase the severity of the interference. When the measure is carried out overtly, the affected persons can not only adjust their communication behaviour in the context of ongoing surveillance measures, they can in principle also challenge the lawfulness of the measure as such – and seek legal assistance if necessary – on the grounds that it does not meet the applicable legal requirements. Moreover, they can, at the very least, check whether the execution of the measure stays within the limits set out in the search order, including the specific instructions for the authorised seizure, and possibly challenge the execution on the grounds that it exceeds the underlying judicial order.

The Code of Criminal Procedure sets out specific safeguards in that respect. § 106(1) first sentence of the Code of Criminal Procedure expressly provides that the affected person must be present during the search. If that person is absent, the overt nature of the measure is to be ensured through the presence of a representative drawn from their family or their neighbours pursuant to § 106(1) second sentence of the Code of Criminal Procedure. If neither the judge nor the public prosecutor is present for the search, § 105(2) of the Code of Criminal Procedure requires, where possible, the presence of a municipal officer or two members of the municipality in whose district the search is taking place.

Furthermore, given that the search measure is carried out overtly, affected persons are not de facto barred from seeking legal recourse – a risk that could otherwise arise if the state interference was carried out without their knowledge.

In addition, the data is not accessed while it is held within the sphere of a third party, most notably the telecommunications intermediary. The specific measure neither requires any technical or organisational arrangements on the part of the telecommunications intermediary, nor does it affect the intermediary’s personnel or material resources, nor expose the intermediary to a conflict of interests with its customer. Accordingly, § 102 of the Code of Criminal Procedure sets lower requirements for search measures directed at the suspect than for search measures directed at a third party (§ 103 of the Code of Criminal Procedure).

Finally, it must be taken into account that the data which the search aims to collect has already entered the domain controlled by the affected persons, where they have actual means to process, protect or delete the data (see C I 2 b above).

While search and seizure measures might entail public stigmatisation of the affected person or severe impairments of their private sphere given that their home is subject to extensive searches, these are not specific to interferences with the right to informational self-determination. §§ 94 et seq. and §§ 102 et seq. of the Code of Criminal Procedure are designed for precisely this type of interference. Where the interference carries particular weight in the individual case, this must be taken into account in the proportionality assessment of that measure.

(3) Due to these differences [between the accessing of communication contents stored on personal devices and telecommunications surveillance as specified in §§ 100a, 100b of the Code of Criminal Procedure], it is not necessary under constitutional law to extend the requirements for exercising the powers set out in §§ 100a and 100b of the Code of Criminal Procedure to the present case. Rather, §§ 94 et seq. , §§ 102 et seq . of the Code of Criminal Procedure provide a sufficient statutory basis authorising the necessary search and seizure measures as this situation is comparable to, for instance, search and seizure measures in respect of written files containing information that might be relevant as evidence.

III.

The challenged orders must also be measured against Art. 13(1) and (2) of the Basic Law.

Art. 13(1) of the Basic Law protects the inviolability of the home. It guarantees individuals a space of private life that is essential to human dignity and the free development of their personality (cf. BVerfGE 42, 212 <219>; 103, 142 <150>). Within their private homes, individuals have the right to be left alone (cf. BVerfGE 51, 97 <107>; 103, 142 <150>). Art. 13(1) of the Basic Law grants a defensive right protecting the sphere of private space within one’s home against state interference, and serves to shield private life against intrusions (cf. BVerfGE 89, 1 <12>).

The guarantee of this fundamental right is strengthened by the fact that, pursuant to Art. 13(2) of the Basic Law, searches may only be ordered by a judge or, in cases of danger requiring immediate action (Gefahr im Verzug ), by other organs designated by law subject to the formal requirements set out in the relevant statutory basis. The requirement of judicial authorisation aims to ensure prior review of the measure by an independent and neutral authority (cf. BVerfGE 57, 346 <355 and 356>; 76, 83 <91>; 103, 142 <151>). The Basic Law rests on the presumption that judges can best and most reliably ensure that the rights of the affected person are respected in the individual case (cf. BVerfGE 77, 1 <51>; 103, 142 <151>) due to their personal and professional independence and the fact that they are bound only by the law (Art. 97 of the Basic Law). The judge must independently examine the requested search measure, and ensure that the requirements arising from constitutional and statutory law be strictly observed (cf. BVerfGE 9, 89 <97>; 57, 346 <355 and 356>; 103, 142 <151>). Within the limits of what is possible and reasonable, the judge has the duty to ensure, by formulating the search order accordingly, that the resulting interference with fundamental rights can be measured and reviewed (cf. BVerfGE 103, 142 <151>).

IV.

1. The considerable interference with both the right to informational self-determination and the right to the inviolability of the home requires justification in accordance with the principle of proportionality in each individual case (cf. BVerfGE 20, 162 <186 and 187>; 96, 44 <51>; 113, 29 <52 and 53>).

a) In particular, the search must be proportionate to the severity of the criminal offence and the strength of suspicion (cf. BVerfGE 20, 162 <186 and 187>; 59, 95 <97>; 96, 44 <51>; 113, 29 <53>). This assessment must take into account how important the potential evidence that the search measure aims to obtain is for the criminal proceedings, and how likely it is that evidence relevant to the proceedings, in the form of physical objects or data, will indeed be found (BVerfGE 113, 29 <57>). For the purposes of criminal investigations, the home of a suspect may be entered only if specific charges can be brought against the suspect, which must be expressly set out – in other words, it requires more than just vague indications or mere assumptions (cf. BVerfGE 44, 353 <371 and 372>; […]). Moreover, the search must have real prospects of success in light of the purpose for which the search order is sought (cf. BVerfGE 42, 212 <220>; 96, 44 <51>).

b) When accessing traffic data stored on a personal device, it must be taken into account that this data merits greater protection (see C I 2 a and C II 5 b cc (1) above). The proportionality assessment must reflect the fact that this data is afforded the special protection of telecommunications privacy if accessed outside the sphere controlled by the person concerned, and the supplementary protection of the right to informational self-determination if accessed within the sphere controlled by the affected person. In this respect, it must be assessed how important the traffic data sought is for the criminal proceedings and how likely it is that relevant traffic data will indeed be found (BVerfGE 113, 29 <57>).

In the individual case, the measure may be impermissible where the criminal act under investigation is a minor offence, the evidentiary value of the traffic data that will presumably be seized is insignificant, or the basis for presuming that evidence will indeed be found is vague.

To the extent that it is possible, under the specific circumstances of the case and without jeopardising the purpose of the investigation, the protection of traffic data must be given consideration in the search order itself, by way of instructions that limit the obtaining of evidentiary material to what is actually necessary. In particular, this may entail narrowing down the relevant time period for which traffic data may be sought, or limiting the search to specific communication devices if it can be ruled out from the outset that data relevant to the proceedings will be found on other devices of the person concerned.

c) When search and seizure measures are carried out – particularly when extensive electronic data records are accessed –, the constitutional standards that this Court developed in its Order of 12 April 2005 - 2 BvR 1027/02 - (cf. BVerfGE 113, 29 <52 et seq .>) must be applied accordingly. In this context, reasonable efforts must be made to avoid obtaining excess data that is irrelevant to the proceedings. The seizure of all data stored on a computer hard drive, or of an entire data processing system, solely for the purpose of obtaining traffic data from, for instance, email correspondence, will generally not be necessary; instead, it will usually be sufficient to inspect the devices at the site of the search in accordance with the purpose of the search, which in any case is limited from the outset.

V.

The challenged orders of the Regional Court do not satisfy these constitutional requirements.

The Federal Constitutional Court does not fully review the lawfulness of the challenged decisions; it merely falls to the Court to review whether the decisions contain an error that is based on a fundamentally incorrect understanding of the significance of a fundamental right, and in particular of its scope of protection, or whether the application of the law no longer appears comprehensible when critically appraising the Basic Law’s central notions (cf. BVerfGE 18, 85 <92 and 93>; 95, 96 <127 and 128>).

Based on these considerations, the challenged orders of the Regional Court violate the complainant’s rights under Art. 13(1) and Art. 2(1) of the Basic Law.

1. The challenged decisions do not interfere with Art. 10(1) of the Basic Law. While the search orders did serve to obtain data on the circumstances of telecommunications, specifically the time of communication and call numbers or line identifiers of the communicating parties, they were nevertheless limited to data stored within the complainant’s private sphere; moreover, the relevant act of communication had already been completed. Under these circumstances, the data is no longer covered by the scope of protection of telecommunications privacy.

2. However, the challenged decisions violate the complainant’s right to the inviolability of her home guaranteed by Art. 13 of the Basic Law and her right to informational self-determination (Art. 2(1) in conjunction with Art. 1(1) of the Basic Law) given that they do not give sufficient effect to the principle of proportionality.

The search order issued by the Regional Court is sufficiently precise, and the court correctly limited the examination of traffic data to the time of the possible crime. There is no need to decide here whether the information on which the order was based actually provided sufficient grounds for suspicion. This is because the suspicion on which the authorities acted, which appears extremely vague at best, could by no means justify the serious interferences with the complainant’s fundamental rights – not least in view of the amount of time that had passed and, as a result thereof, the extremely low chances of actually finding relevant evidence.

a) The grounds for suspicion implicating the complainant were not very strong. This already follows from the large number of possible suspects in connection with the disclosure of the information. Some of them were ruled out as suspects solely on the basis of their own testimony, whereas the complainant was not given the opportunity to give evidence herself as she was never actually questioned. Others – such as lawyer F. – were not even considered as suspects; rather, the investigations were directed solely against the complainant as a suspect, merely because she had stated in a different context that she knew the Spiegel reporter.

In the Order of 5 February 2004 - 2 BvR 1621/03 - […] [which had reversed and remanded an earlier decision by the Regional Court in this matter], the Third Chamber of the Second Senate of the Federal Constitutional Court had already directed the Regional Court to critically assess whether it actually seems probable that the information was disseminated by a journalist working for a weekly magazine, i.e. someone who should have been particularly interested in not making the information public right away. Yet the Regional Court failed to address this question in a substantiated manner. Instead, it only stated apodictically that it cannot generally be assumed that journalists work exclusively for one press medium and would thus refrain from sharing information with other journalists.

The now challenged decision of the Regional Court relies on the statement by law office employee S., made in her interrogation on 28 October 2002, that she was not “one hundred per cent sure” that the Focus editor did call the law firm on the date of the hearing. In this respect, the court refrained from examining the contradictions between this statement and the earlier statement by lawyer N. (note in the police file dated 23 October 2002), according to which on the afternoon of 6 September 2002 he saw a written note listing calls from both news magazines that day. The court simply assumed that the lawyer must have been mistaken. Yet this assumption seems untenable given that during previous questioning, employee S. was not only able to repeatedly recall the approximate time of the call from the Focus editor on 6 September 2002 but was also able to distinguish it from calls made by other journalists the following week (police file note of 23 October 2002).

The Regional Court assumed that these facts did not necessarily exclude the complainant as a suspect. This assumption, however, was evidently not an adequate basis for establishing a sufficiently strong suspicion against the complainant.

b) Furthermore, the Regional Court did not sufficiently take into account that it remains doubtful that the disclosure of official secrets posed a threat to important public interests within the meaning of § 353b(1) of the Criminal Code in the present case.

[…] It appears that the Regional Court, which by its own account did not consult the files of the initial proceedings, simply accepted at face value the vague statement by the police that a “planned” surveillance operation had to be “aborted”. The police submitted this statement for the very first time in connection with the investigations against the complainant, and failed to provide any further details even after the statement was challenged by the complainant.

According to prevailing opinion, a specific danger (konkrete Gefahr ) threatening public interests [as a constituent element of criminal liability] also includes indirect dangers, for instance, situations where the disclosure of official secrets could undermine the public’s trust in the impartiality, incorruptibility and proper functioning of public administration […]. However, the Regional Court failed to establish the necessary specific findings in that regard, which would have required the court to carry out an overall assessment of all relevant circumstances of the individual case […].

c) The Regional Court asserted that the original files from the initial proceedings were not consulted because the documents submitted to the court did not indicate any contradictions. This assertion is unconvincing in light of the rather vague suspicion which prompted the Regional Court to order further investigations. Once again, the Regional Court failed to provide a convincing answer as to why the original files were not consulted. An explanation would have been necessary in this regard given that the suspicion against the complainant was vague at most and required further investigations, but also in light of the high standing accorded to the affected fundamental rights and in consideration of the office held by the complainant. Notably, there was no time pressure as the proceedings had been pending for several months already. A comparison of the file contents known to the complainant with the contents reported by the media, most significantly in the Handelsblatt article of 8 September 2002, would have shown that the media reports contained information that was not in the original files, and that therefore could not have been known to the complainant. By contrast, the information was in fact part of a confidential preliminary police report that had in the meantime been submitted to the Regional Court […].

d) Furthermore, it was doubtful from the outset whether the search was even suitable for finding evidence. At the time of the search order, almost five months had passed since the alleged crime, during which the law enforcement authorities had conducted extensive investigations within the complainant’s immediate professional environment. Even if the complainant had been the only one not interrogated about the events, the authorities must have expected that she had become aware of the suspicion against her. The Regional Court should therefore have considered the possibility that the complainant – if there were even grounds for considering her as a suspect in the first place – might have destroyed or deleted evidence of any messages to journalists.

e) The interference with the sphere of private space within the complainant’s home is serious, including with regard to her professional position. She had emphasised in the proceedings pursuant to § 33a of the Code of Criminal Procedure [application to reinstate the procedural status quo ante ] that the search of her home significantly affected her professional position as an examining judge. Yet in its subsequent order, the Regional Court merely stated, without any further explanation, that it did not consider the search order to be incompatible with constitutional requirements. Thus, the Regional Court neglected to conduct the required proportionality assessment regarding the interference that would have been imperative given the considerable impairment of fundamental rights. For an examining judge, being accused of a breach of official secrets is particularly stigmatising, which is why caution is generally advised when making such accusations. If investigating authorities and courts signal, by searching the suspect’s premises, that they pursue and confirm such a suspicion, the adverse effects of such accusations are further aggravated. In any case, a particularly thorough review must be carried out regarding the grounds for suspicion if the investigation measure in question is not a matter of urgency.

f) In addition, the Regional Court’s decisions did not take into account the significance of the right to informational self-determination (Art. 2(1) in conjunction with Art. 1(1) of the Basic Law), in that the court ordered search measures to investigate telecommunications circumstances without giving consideration to the weight of the interference resulting from the accessing of traffic data that is afforded special constitutional protection.

g) The questionable suspicion, and the substantial doubts regarding the suitability of the search measure, render the measure disproportionate in relation to the interference with the inviolability of the home and the complainant’s right to informational self-determination Constitutional law would thus have required the Regional Court to reject the application for a search order.

VI.

1. The orders of the Regional Court are reversed on the grounds that they violate Art. 13(1) and (2) and Art. 2(1) of the Basic Law (§ 95(2) of the Federal Constitutional Court Act). […]

2. […]

D.

[…]