Balancing digital data protection (digital privacy) and Protection of National Security

a) The authorisation of the Federal Criminal Police Office to carry out
covert surveillance measures (surveillance of private homes, remote
searches of information technology systems, telecommunications surveillance, collection of telecommunications traffic data and surveillance outside of private homes using special means of data collection)
is, for the purpose of protecting against threats from international terrorism, in principle compatible with the fundamental rights enshrined
in the Basic Law.
b) The design of these powers must satisfy the principle of proportionality. Powers that constitute a serious interference with privacy must
be limited to the protection or legal reinforcement of sufficiently
weighty legal interests; require that a threat to these interests is sufficiently specifically foreseeable; may, only under limited conditions, also extend to third parties from whom the threat does not emanate and
who belong to the target person’s sphere; require, for the most part,
particular rules for the protection of the core area of private life as well
as the protection of persons subject to professional confidentiality;
are subject to requirements of transparency, individual legal protection, and supervisory control; and must be supplemented by deletion
requirements with regard to the recorded data.
2. The requirements for the use and transfer of data collected by the
state follow the principles of purpose limitation and change in purpose.
a) The scope of a purpose limitation depends on the specific legal basis for the data collection: the data collection initially takes its purpose
from the respective investigation procedure.
b) The legislature may allow a use of the data beyond the specific procedure of the data collection in the context of the original purposes of
the data (further use). This implies that the use of collected data is limited to the same authority acting in the same function and for the protection of the same legal interests. For data from the surveillance of
private homes or from access to information technology systems,
each further use must additionally also fulfil the relevant risk situation
requirements applicable to the data collection.
1/71
c) Moreover, the legislature may also allow for a further use of data
collected by the state for other purposes than those determining the
original data collection (change in purpose)