Federal Data Protection Commissioner cannot sue for access to BND information
The Federal Administrative Court dismisses a lawsuit by the BfDI. It cannot sue for "access to orders from the President of the Federal Intelligence Service".
The BND presents its oversight as a multi-stage system – but according to the Federal Administrative Court, the BfDI cannot judicially enforce rights of access in disputes.
(Image: BND)
The Federal Administrative Court (BVerwG) has dismissed the lawsuit filed by the Federal Commissioner for Data Protection and Freedom of Information (BfDI), Prof. Louisa Specht-Riemenschneider, against the Federal Intelligence Service (BND) for "access to orders from the President of the Federal Intelligence Service" as inadmissible. The proceedings (Ref. 6 A 2.24) concerned whether the federal government's highest data protection authority can judicially enforce its control rights over the foreign intelligence service.
According to the court's decision, this is not the case. "The provision of § 63 BNDG in conjunction with § 28 para. 3 sentence 2 no. 1 BVerfSchG [...] does not allow for a legally enforceable position of defense that can be enforced through administrative court proceedings," states the BVerwG.
With the lawsuit, the BfDI wanted to clarify whether it could take legal action if access was denied by the BND. "Through the lawsuit, I wanted to ensure that no practical control gaps arise so that fundamental rights can be effectively protected. According to the Federal Administrative Court, I cannot judicially enforce my independent control powers; I do not have a 'defensible legal position' for a lawsuit," said Specht-Riemenschneider.
Previously, the BfDI had objected to the denial of access to the Federal Chancellery. The Chancellery rejected this, referring to the primacy of control by the Independent Control Council (Unabhängiger Kontrollrat, UKR); the Federal Administrative Court did not comment on the delimitation of competences between the UKR and the BfDI.
Fear of control-free zones
In the court's opinion, the BfDI is only entitled to object to the Federal Chancellery in case of disputes over access rights. However, this instrument does not involve directly enforceable remedies or enforcement rights – in line with the legislator's intent. The data protection officer's own right to sue would undermine this legal construct. "As a consequence of the ruling, I fear that control-free zones will emerge in the intelligence services. The controlled entity can now effectively decide for itself what is made available to me for inspection and thus what I control. The legal situation is absurd and must be corrected," said the BfDI.
Videos by heise
She therefore calls for a legislative amendment. "In my view, there must always be an instance that decides on contentious issues. However, this instance cannot be the Federal Chancellery, because within the executive branch, I am completely independent and not subject to instructions. I must be able to enforce my control rights in court in the interest of protecting fundamental rights. I appeal to the legislator to give me a legal avenue for disputes concerning my control rights and obligations with the BND."
The background to the proceedings was an on-site inspection by the data protection authority at the BND. There, the service denied access to certain orders for individual intelligence gathering measures. Specifically, this concerned CNE measures (Computer Network Exploitation), "which are necessary to justify the 'hacking' of IT systems of foreigners abroad." In the BfDI's assessment, these are particularly intrusive measures that require careful data protection control.
"Citizens have hardly any means to defend themselves against intelligence measures that can deeply interfere with their privacy, due to the secret data processing carried out by the intelligence services. Therefore, the Federal Constitutional Court has assigned me a compensatory function. My ability to enforce the rights of data subjects is massively restricted by today's ruling." The BfDI now intends to examine the consequences of the ruling for the enforcement of data protection requirements at national and European level.
In the past, the current and a former BfDI had already emphasized the importance of independent control of the BND – especially regarding further planned investigative powers in the digital space. There have repeatedly been disputes over the control of intelligence services, for example because the Federal Intelligence Service had refused access to documents.
(mack)
