Systematic Government Access to Private-Sector Data in Germany

Privacy and Security, Networks, the Internet, and Cloud Computing and Cloud Computing

Article Snapshot


Paul M. Schwartz


in Bulk Collection: Systematic Government Access to Private-Sector Data, Fred H. Cate and James X. Dempsey, eds., Oxford University Press, 2017, pp. 61-90


German law recognizes strong privacy rights and limits surveillance. However, police and intelligence surveillance powers have expanded since the end of the Cold War. International firms may violate German law by sharing data stored in the cloud with authorities in the United States.

Policy Relevance

German authorities are concerned about data transfers to the United States. New laws have expanded surveillance within Germany.

Main Points

  • The German Constitution recognizes strong guarantees of civil liberties and privacy rights; however, terrorist attacks in the United States and Europe have strengthened a trend towards more concern about national security and crime in Germany.
  • Public-sector entities in Germany may collect and process personal information only under certain conditions.
    • The agency must have a statutory basis for its processing of personal data.
    • The agency must follow the principle of proportionality, showing that it has chosen suitable, necessary, and reasonable means to its goals.
  • The German Constitutional Court ruled that the collection of large amounts of communications data for foreign intelligence purposes must be limited according to the principle of proportionality; data may not be shared with foreign agencies unless a serious crime had been committed.
  • General data protection law limits the storage, alteration, or use of personal data by private entities to situations when necessary to carry out the purposes for which the data were collected; similar restrictions apply to public entities.
  • German law separates law enforcement from intelligence services, and domestic intelligence from foreign intelligence; new legislation has expanded the powers of the intelligence services and the police, and empowered these agencies to share more information.
  • The German Constitutional Court has ruled that privacy protection may apply to some communications outside the borders of Germany; firms like Microsoft, which are based in the United States, may be required to release private consumer data stored "in the cloud" to authorities in the United States, but this would violate German law.


Get The Article

Find the full article online

Search for Full Article