A. Introduction

Since the 1980s Germany has developed a subtle and complex data protection jurisprudence originally designed to protect individual data subjects from rights abuses by market actors.  However, the rights aggressor has increasingly been German and European law enforcement authorities. This evolving corpus of law also exhibits a singularly-German mindfulness of the historical significance of abrogating fundamental rights within constitutional democracy.

In the wake of the 9/11, Madrid, and London Terror attacks, the European Union (EU) expanded a new phase of cooperation in law enforcement emphasizing preventive domestic anti-terrorism measures.   While many countries were complicit, the major drivers of more stringent anti-terrorism policy were the United Kingdom and the United States.  A key plank of this Anglo-American agenda has been electronic communications surveillance.

In 2006, the EU institutions passed an EU-wide Data Retention Directive  pursuant to which all communications traffic data is captured and stored by communications services providers (CSPs) for a period of up to two years. Flexibly-designed to allow for member state subsidiarity, German legislators considerably overstepped the Directive’s minimum requirements when they transposed it into German law a year later.  Assorted German law enforcement and other agencies are provided access to the data in service of varied state purposes.  The law transposing the Directive enormously burdened fundamental rights guaranteed by the Grundgesetz (Basic Law).  Moreover, it failed to meet legal standards of certainty and proportionality and has been declared verfassungswidrig (unconstitutional) by the Bundesverfassungsgericht (BVerfG - Federal Constitutional Court) in a landmark ruling announced in March 2010.

Yet, by accepting the basic rights protections of the Directive, the Constitutional Court’s decision avoided a potential showdown with the European Court of Justice (ECJ) in Luxembourg.

This paper has two goals: to impart an understanding of the theory and legal application of German data protection and to illustrate the how the German law...