Supervision over federal intelligence services
Within the scope of their legal mandate, the federal intelligence services process a wide range of data from different sources, including digital communication and information flows, from which they collect and evaluate, for example, the content and metadata of telecommunications. Various control bodies check whether this is carried out correctly.
Even for intelligence services, data collection and processing are not possible without restrictions, but these activities are limited by various special laws with regard to the purposes, type and scope of data processing. The main legal bases for data processing of the federal intelligence services – the Federal Office for the Protection of the Constitution (BfV), the Federal Office for the Military Counterintelligence Service (MAD) and the Federal Intelligence Service (BND) – are the Federal Act on the Protection of the Constitution (BVerfSchG), the Act on the Military Counterintelligence Service (MADG), the Act on the Federal Intelligence Service (BNDG), the Act on Restrictions on the Secrecy of Mail, Post and Telecommunications (G10G) and the Telecommunications Act (TKG). The Federal Armed Forces (Bundeswehr) in the field of the military intelligence (MilNW) bases its own actions on the Basic Law and on a partial application of the GDPR.
It is necessary that data processing operations by the intelligence services and the military intelligence system happen covertly, so that the usual possibilities to perform data protection controls concerning governmental action – especially data subjects’ right to information – are limited. This is compensated by the control bodies’ supervisory activities. Their task is to ensure that the covert data processing takes place within the legal framework and that the techniques and procedures used for this purpose comply with this framework.
The control bodies for the federal intelligence services are:
- The Parliamentary Oversight Panel
- The G10 Commission
- The Federal Commissioner for Data Protection and Freedom of Information
- The Independent Oversight Council
These control bodies have specific, sometimes overlapping tasks.
As a committee of the German Bundestag, the Parliamentary Oversight Panel controls the federal intelligence services (BND, MAD and BfV). The Parliamentary Oversight Panel is to be fully informed by the Federal Government about the general activities of the above-mentioned Federal Intelligence Services and about operations of particular importance under the Parliamentary Oversight Panel Act. Concerning the cooperation of the control bodies, a central position will be provided for the Parliamentary Oversight Panel as of 01/01/2022 by the Parliamentary Oversight Panel Act.
From a legal and a technical point of view, and on the basis of the G10G, the G 10 Commission examines interference by the intelligence services of the federal government (and the Länder) in the secrecy of telecommunications protected by Art. 10 para.1 of the Basic Law (GG).
The BfDI is also competent for controlling all federal intelligence services’ interventions in the fundamental right to informational self-determination (“fundamental data protection right”).
In this context an overlap with the G 10 Commission’s oversight competence may arise, since the same data processing often intervenes in the areas of protection of both fundamental rights (informational self-determination and secrecy of telecommunications), but only the G 10 Commission has the power to examine any interference in Art. 10 of the GG. In practice, this sometimes leads to complex coordination processes between the BfDI and the G10 Commission. Conversely, the BfDI cannot on his own initiative control data collections falling under the G10G.
The Indepentdent Oversight Council
In the course of the adoption of the amendment of the BNDG (Law amending the BND Act for the implementation of the provisions of the Federal Constitutional Court and the Federal Administrative Court, adopted by the Bundestag on 15 March 2021), the Independent Oversight Council was added to the existing bodies competent for controlling the BND.
The Independent Oversight Council has started its activities at the turn of 2021/2022. Since that date, the Independent Oversight Council is tasked with monitoring the BND’s activities in the field of technical reconnaissance, in particular the so-called strategic monitoring of telecommunications abroad. At the same time, the BfDI’s existing data protection control competence in this area concerning the BND as well as the control competence of the G 10 Commission for interventions in Art. 10 GG remain unrestricted.
It is true that the BNDG, which was amended for the most part with effect from the turn of the year 2021/2022, provides for an exchange of information between the control bodies, but limited to only general matters of the control activity. Information exchanges also on individual cases and specific aspects of the control bodies’ controlling activities would allow to make the control of intelligence services much more efficient and coordinated. Unfortunately, this demand was not taken up in the legislative procedure for the BNDG, so that the diversity of the control landscape over the intelligence services, which has long been criticised by the BfDI, persists.