German law has been deemed inadequate at protecting the constitutional right of German citizens to privacy.
The federal Constitutional Court in Karlsruhe ruled that the extent to which the German police can access people's internet and cell phone data was unconstitutional and that the country's privacy laws need to be revised.
Currently, German law enforcement agencies investigating crimes or working to prevent terror attacks are permitted to access names, addresses, birth dates, and IP addresses from telecom companies, hospitals, and hotels without the approval of a judge. However, they are not allowed to access data regarding an individual's connections to other people.
The ruling comes after campaigners voiced a challenge to the country's existing privacy laws, requesting that German police should only be allowed to access phone and internet data if a crime is suspected and in the event of a specific danger.
Proving that the wheels of justice really do turn slowly, the first of two lawsuits created to challenge the police's access to data was filed to the court back in 2013. The suit, which was backed by 6,000 people, was brought by European Pirate party politicians Katharina Nocun and Patrick Breyer.
The plaintiffs complained that German police were routinely given access to data including PIN numbers and email passwords from a variety of sources when investigating relatively minor crimes.
Nocun and Breyer said that the sweeping access to users’ private data permissible under German law risked the creation of “a new secret police of the internet that can ransack and scan our most intimate thoughts.”
The Constitutional Court ruled that investigators can be given access to the data of users in principle, but that it needs to happen in a way that doesn't impinge on a citizen's right to privacy.
Following the court's ruling, the German government must now obey an order to reform the nation's Telecommunications Act by the conclusion of 2021. The Act was last revised in 1996.
Revision of the Act is likely to impact how a newly enshrined law designed to combat far-right extremism is upheld. The law requires Facebook, Twitter, and YouTube to report hate speech to police and delete harmful content within 24 hours of its being posted.