1. Basic Rights Also Apply to Foreigners Abroad

The main and groundbreaking^{Footnote 5} holding of the judgment is that the BND is also bound by the Basic Law abroad.^{Footnote 6} This is the first time that the Court has affirmed the application of German fundamental rights to situations outside German territory.^{Footnote 7} The Court explained that the Basic Law binds every form of German state power, even if it acts in a foreign context, because Article 1(3) states that the basic rights shall bind the legislature, the executive, and the judiciary as directly applicable law. No limitation could be inferred from the wording.^{Footnote 8} Moreover, the Court argued that this interpretation is consistent with Germany’s integration into the world’s community of states, including the alignment of human rights.^{Footnote 9} It is already striking how intensively the Federal Constitutional Court incorporates international law by considering the legal situation under the European Convention on Human Rights (ECHR). This has the potential to bring about a rethinking beyond the individual case: Due to the manifold interrelationships between international and national law and international cooperation, the Basic Law must be interpreted and applied in accordance with international law.^{Footnote 10}

2. Human Rights as a Limit for Data Transfer to Foreign Intelligence Services

In addition, the judges addressed cooperation between the intelligence agencies and concluded that special requirements apply to the transmission of data to foreign agencies.^{Footnote 11} The Court insisted that the legislature demand constitutional protections on both sides of transfer,^{Footnote 12} holding that the same requirements that apply to the transmission of data to domestic offices apply also to the transmission of data to foreign agencies.^{Footnote 13} In particular, this means that the threshold of interference for data transmission must be specified. This is important because the data collection itself does not require a threshold of interference but is independent of the occasion.^{Footnote 14} The Court concluded that the knowledge gained regardless of the event can be made accessible for further processing only if a survey according to general rule of law requirements for transmission purposes would be justified.^{Footnote 15} Therefore, a sufficiently specific risk situation is necessary for the transmission.^{Footnote 16} In addition, the Court imposed further requirements for transmissions to foreign bodies—according to the judges, the rule of law needs to be verified by the BND.^{Footnote 17} This includes both the safeguarding of data protection guarantees and the safeguarding of human rights when using the information.^{Footnote 18} This requires sufficiently clear and specific legal standards that ensure this assurance of the BND.^{Footnote 19} The Court makes it clear that this does not mean that the same standards exist as in Germany. But from the judges’ point of view, it is clear that human rights guarantees for the protection of personal data must be observed.^{Footnote 20} In addition, transmission is always ruled out if elementary principles of the rule of law are violated.^{Footnote 21} For clarification, the German Constitutional Court mandates compliance with the ECHR and other international human rights treaties.^{Footnote 22} The judgment requires that the information not be used to persecute certain population groups, to suppress opponents, to kill or torture people in violation of international human rights law or international humanitarian law, or to detain people without a fair trial.^{Footnote 23} Addressing the extent of the assurance, the Court held that an individual examination is not always necessary. Rather, a general factual assessment of the situation in the recipient country is generally sufficient.^{Footnote 24} If the general assessment yields doubts, individual commitments must be obtained.^{Footnote 25}

1. Data Protection and Right to Privacy

The most germane human right named by the German Constitutional Court is the right to data protection.^{Footnote 48} There is no universal concept for data protection in public international law. In particular, there is no relevant international treaty and no developed state practice.^{Footnote 49} Nevertheless, the right to privacy is now understood to include cyberspace.^{Footnote 50} In connection with the international work of foreign intelligence services, Article 17 of the International Covenant on Civil and Political Rights (ICCPR) is of particular importance and a universal standard.^{Footnote 51} For example, the UN Human Rights Council^{Footnote 52} and the UN Human Rights CommitteeFootnote ⁵³ have emphasized that the right to privacy also applies to online communication. Thus, the systematic collection and storage of connection data as well as the interception of mobile conversations or online searches can interfere with the right to privacy.^{Footnote 54} However, not every intervention is a violation of Article 17.^{Footnote 55} This is shown by its wording, which speaks of arbitrary or unlawful interventions. Therefore, an intervention is justified if the national legal basis itself is also compatible with the ICCPR.^{Footnote 56} In this regard, the UN Human Rights Committee has, for example, criticized the legal foundations of the surveillance activities of the United States. In the 2014 state party report, the Committee suggested regulatory reforms requiring at least guarantees against data misuse.^{Footnote 57} In the report, the committee stated that it was also particularly important that individuals concerned have access to effective complaint mechanisms.^{Footnote 58} While the reforms urged by the Committee were formulated as recommendations, these reforms would best be considered necessary for the protection of rights under the ICCPR.^{Footnote 59} At the same time, the High Commissioner for Human Rights recognized that, provided surveillance takes place on grounds of national security or for the prevention of terrorism or another crime,^{Footnote 60} intelligence gathering is a legitimate governmental aim. Ultimately, this involves a tradeoff under the principle of proportionality.^{Footnote 61}

2. Universally Recognized Human Rights

The Court also prohibited data collection where elementary principles of the rule of law—for example, human dignity—are not followed.^{Footnote 62} From the judges’ point of view, it is particularly important to prevent information from being used to (i) persecute particular population groups; (ii) suppress opponents; (iii) kill or torture people in violation of international human rights law or international humanitarian law; or (iv) detain people without due process.^{Footnote 63} Legislatures must ensure that the ECHR and other universal human rights treaties are complied with.^{Footnote 64} This is convincing because the upholding of internationally recognized human rights can be expected from every cooperation partner.^{Footnote 65} However, it is important to determine these universally recognized human rights. These include not only those human rights that are jus cogens but also the rights set out in the Universal Declaration of Human Rights (UDHR), the International Covenant on Civil and Political Rights (ICCPR), the International Covenant on Economic, Social and Cultural Rights (ICESCR), the Convention on the Elimination of All Forms of Discrimination against Women (CEDAW), and the International Convention on the Protection of the Rights of All Migrant Workers and Members of Their Families (ICRMW). This already follows from the United Nations’ Millennium Declaration, in which 189 UN member states defined numerous binding goals and specified the concept of “internationally recognized human rights.”^{Footnote 66} What is common to these contracts is that they have a high level of ratification—or, in the case of the UDHR, enjoy a high level of acceptance—and that they contain a large number of regulations under international law.^{Footnote 67} Accordingly, they serve as a good reference point in the field of intelligence services. By contrast, it is not convincing to attach such a high value to the ECHR because it is only a regional treaty that cannot claim universality.^{Footnote 68} This does not mean that the ECHR is superfluous in these cases, as the BND is bound by it.^{Footnote 69} However, this instrument does not apply to all intelligence agencies; it does not apply to U.S. intelligence agencies, for example.^{Footnote 70} That is why it is important to refer to universal human rights and, if necessary, to contextualize them with regional human rights treaties. This means that the intelligence agencies are bound by all the rights guaranteed in these universal human rights treaties and the BND must ensure that the information that is to be transmitted is not used for purposes that conflict with these rights. Besides the right to privacy, the prohibition of torture,^{Footnote 71} the right to life,^{Footnote 72} and the prohibition of discrimination^{Footnote 73} are particularly significant.^{Footnote 74}

Of course, these rights do not all apply without restriction, but what is clear is that utmost consideration must be given to the principle of proportionality.^{Footnote 75} It is not clear why the set of human rights by which intelligence services are bound should be limited to basic human rights. It has been pointed out that the intelligence services are bound by human rights; if they do not fulfill their obligation to uphold human rights, they violate international law. If the aim is to prevent the circumvention of standards, this obligation must apply to all human rights without distinction. In addition, it must be recognized that it must be a violation of human rights and not only an infringement. References to fundamental human rights are therefore misleading. The new Section 30 of the revised BNDG—which came into force in January 2022—establishes a ban on transmission in cases of significant human rights violations or violations of elementary principles of the rule of law. The new Section 30 does not, however, limit the set of relevant human rights to fundamental human rights. The provision’s limitation of the set of relevant human rights violations to those that are significant in nature is in line with the Federal Constitutional Court’s ruling, as the Court also makes clear through its exemplary enumeration of killing and torture that significant human rights violations shall be prevented.

1. Legal Framework

The U.S. also has different intelligence services for different tasks. The Federal Bureau of Investigation (FBI) is responsible for domestic counter-terrorism, police investigations, prosecution of organized economic and violent crime, and counter-espionage. The Central Intelligence Agency (CIA) is the American foreign intelligence service. The National Security Agency (NSA) is also responsible for foreign countries, but it concentrates on signals intelligence. Although after the Snowden revelations the U.S. and especially the NSA were criticized by Germany in particular, it quickly became clear that the legal foundations of the U.S. and Germany did not differ very much with regard to surveillance abroad. At the core of the U.S. regulatory framework is the Foreign Intelligence Surveillance Act (FISA). The aim of this law is to set limits on surveillance abroad. In contrast, domestic surveillance is primarily regulated by the USA PATRIOT Act. As in Germany, different standards apply to domestic surveillance than to surveillance abroad. Under Section 702 of FISA, foreign entities and individuals can be targeted. According to this legal basis, private interests are respected only in the case of U.S. citizens—not in the case of foreigners.^{Footnote 86} According to dominant opinion, the U.S. Constitution operates in the same way: There are only limited possibilities for extraterritorial effect of the Constitution with regard to foreigners. This means especially that intelligence operations abroad against non-U.S. citizens are not affected by constitutional guarantees.^{Footnote 87} Due to the Snowden revelations, the Obama administration passed Presidential Policy Directive 28 (PPD-28).^{Footnote 88} which was not repealed by Trump. This Directive sets limits on mass surveillance and the same standards of protection for foreigners as for U.S. citizensFootnote ⁸⁹ However, this does not establish subjective rights and does not have the force of law—none of this was codified in FISA itself.^{Footnote 90} Moreover, mass surveillance measures continue to be permissible for unlimited purposes so long as the data is stored for only a limited period of time.^{Footnote 91} Moreover, there is no mention of respect for human rights in the surveillance law of the U.S. With the new BND law, larger differences between the U.S. and German legal situations are emerging.

2. Human Rights Record

In addition, there are also doubts about human rights compliance at the factual level. In 2014, the Committee against Torture criticized that the U.S. did not provide information on the practices of extraordinary rendition, enforced disappearance, or on the extent of abusive interrogation techniques, such as waterboarding, used by the CIA on suspected terrorists.^{Footnote 92} The Committee clarified that the ban on torture is absolutely guaranteed and that no justification is possible.^{Footnote 93} Additionally, the Committee referred to its second general comment, in which it states that even exceptional circumstances like terror or war are not grounds for justification.^{Footnote 94} Moreover, the UN Human Rights Committee in 2014 was troubled by the operations and practices of two U.S. agencies in particular—the FBI and the NSA. The Committee expressed concern about racial profiling by the FBI^{Footnote 95} and focused on NSA surveillance with unusual specificity.^{Footnote 96} The Committee criticized not only the data collection methods of the NSA, but also the fact that NSA oversight does not work well and that there are no effective enforcement mechanisms.^{Footnote 97} Even though these fears are not new, they are likely to raise doubts about the compatibility of the intelligence services’ work with human rights. In view of the principles described by the German Constitutional Court in the BND judgment, it is clear that data transfer will no longer be permissible without additional scrutiny, as there are doubts regarding human rights compliance. For this reason, the BND will have to be assured in each individual case that the transfer of information will not lead to human rights violations.

1. Legal Framework

Israel is meant to serve here as an example of a whole series of states—namely, States in which the work of intelligence services is only rudimentarily regulated by law and is overseen to only a limited extent by legislatures, courts, and other institutions.^{Footnote 98} These include, for example, States like China, Russia, and Iran. It is difficult to find up-to-date information on the work of intelligence agencies. The difficulty of monitoring the work of intelligence agencies, given the fact that such work remains mostly secret, is particularly evident in the case of Israel. This lack of transparency and the at least partial lack of a legal basis are problematic with regard to the rule of law.^{Footnote 99} That is not to say that there is no legal basis at all. With the General Security Law 2002, the Knesset created a legal basis for the General Security Service (GSS). This has brought at least some intelligence activities out of secrecy. However, it is also clear that sensitive issues such as torture have remained shrouded in secrecy.^{Footnote 100} In addition, this legal framework is only for domestic surveillance, not for foreign telecommunications intelligence.^{Footnote 101} There is still no legal basis in these matters. This is a significant difference from states like Germany. This deficiency alone ought to mean that data transfers are no longer possible without an assurance in each individual case.

2. Human Rights Record

Furthermore, even with little information on human rights matters, there remain considerable concerns as to whether Israel’s intelligence agencies are compliant with the German Constitutional Court’s criteria. Both the Committee against Torture and the Human Rights Committee are concerned about the use of torture by security agencies.^{Footnote 102} Therefore, it can at least be seriously doubted whether human rights are respected. In view of the German Constitutional Court’s criteria, it can be assumed that cooperation with Israeli intelligence services is no longer permissible without obtaining assurances in each individual case that the information will not be used to commit human rights violations.

1. Legal Framework

There are three principal intelligence services in the UK: the Security Service (MI5), the Secret Intelligence Service (MI6), and the Government Communications Headquarters (GCHQ). Because the UK, unlike most other states, has no written constitution, there is no constitutional basis for the intelligence services. Nevertheless, there are other legal foundations. The Security Service Act 1989 and the Intelligence Service Act 1994 set out the principles on which the intelligence services operate.^{Footnote 103} These acts are very similar in design, but leave room for flexibility in view of the different areas of activity.^{Footnote 104} According to the 1989 Act, MI5 is responsible for the protection of domestic national security from threats internal or external to the British Isles.^{Footnote 105} More relevant to the aims of this article is MI6, which is the counterpart of the German BND and focuses on foreign and defense interests. In addition, it must be considered that after Snowden’s disclosures, the legal framework was fundamentally revised.^{Footnote 106} The Investigatory Powers Act 2016 brought intelligence-agency and law-enforcement powers for surveillance of communications and access to communications data together in one place and extended the power to cover additional new technologies, for example, bulk collection of data.^{Footnote 107} At the same time, a “double-lock” approval process was also introduced, under which both the Secretary of State for the Home Department and subsequently a Judicial Commissioner must authorize a warrant before it can be issued. The key players in this oversight arrangement are the Judicial Commissioners, a set of judicial officials that includes and is headed by the Investigatory Powers Commissioner.^{Footnote 108} It seems to be no coincidence that one of these Judicial Commissioners testified as an expert before the German Constitutional Court; the Court had the Judicial Commissioners in mind as a model for the new supervisory body in Germany. However, this process does not require checking whether cooperation partners respect human rights. Thus, the legal standards that UK intelligence agencies must comply with differ in a small way from the standards that the German Constitutional Court requires German law to establish in this area.

2. Human Rights Record

In theory, therefore, the UK is well prepared: There is a legal basis for action abroad, and its monitoring mechanisms are used as a model beyond the UK. However, this does not mean that the intelligence services consistently respect human rights. Even before the Snowden disclosures, it was clear that the British intelligence services^{Footnote 109} were involved in the torture and kidnapping of terrorism suspects after 9/11.^{Footnote 110} The Snowden revelations had a major impact on UK intelligence agencies as they too were revealed to be involved in mass surveillance.^{Footnote 111} In this context, the ECtHR delivered its judgment in Big Brother Watch and others v. the United Kingdom—a case which is not yet final, but pending before the Grand Chamber.^{Footnote 112} In that case, which arose in the aftermath of the Snowden revelations, the Court considered in detail the UK surveillance regime and held that certain aspects of it violated Articles 8—the right to respect for private and family life—and Article 10—freedom of expression— of the Convention.^{Footnote 113} Moreover, in this case, the court was asked for the first time to consider the issue of an intelligence-sharing regime’s compliance with the Convention. The judges concluded that there were no significant shortcomings in the application and operation of the U.S.–UK intelligence sharing regime and therefore that there was no violation of Article 8 ECHR.^{Footnote 114} This, along with the other issues described thus far in this paragraph, would be reason enough to doubt whether information can still be transmitted to British intelligence services. But there is yet more cause for concern. Namely, there are some doubts as to whether the British intelligence community upholds all human rights. A report by the Committee against Torture emphasized torture allegations against the UK. Following the publication of the report, the UK did not fully investigate these allegations, nor did the UK hold the perpetrators accountable.^{Footnote 115} In this respect, however, it should be noted that the alleged acts of torture, assuming the allegations are true, took place a considerable time ago and that there is no evidence that this mistreatment is still going on. Therefore, the allegations are not on their own sufficiently indicative of the current level of protection of human rights by the UK. This is particularly true in view of the new reforms. Therefore, a general assessment by the BND should be sufficient. Only when concrete evidence of human rights violations re-appears will case-by-case assurances become necessary.