The judgment of the German Constitutional Court of 15 December 1983 on the German Census Act of 1983 (the so-called "census judgment") had a long-lasting effect on the development of data protection law. Below I briefly review the background of the 40-year-old census judgment and its impact on the thinking about data protection.
This year is full of important data protection-related anniversaries. May 11 marked 50 years since the first national data protection law was passed in Sweden (which came into force a year later). This year also marked 45 years since the first federal data protection law (Bundesdatenschutzgesetz) came into force in Germany on 1 January 1978. And on May 25, we celebrated the 5th anniversary of GDPR becoming applicable.
What was the background to the judgment?
The Census Act of 1983 (Volkszählungsgesetz) was adopted in Germany, on the basis of which the census was to be conducted in 1983. However, this could not happen because many people complained to the German Federal Constitutional Court (Bundesverfassungsgericht) about the large number of data to be collected in connection with the census and the possibility to compare the data with other registers. The census was suspended pending the outcome of the complaints, and after the German Federal Constitutional Court ruled that the Census Act was unconstitutional in its judgment (Volkszählungsurteil), the census planned for 1983 was cancelled (after appropriate guarantees had been established, the census could finally take place in 1987).
What were the main findings of the judgment?
The census ruling declared the so-called right of informational self-determination (in German: "informationelle Selbstbestimmung"), i.e. the right of citizens to control the use and processing of their data. This right was derived by the German Constitutional Court from the 'right to the free development of the personality' (Article 2(1) of the Basic Law for the Federal Republic of Germany), which was interpreted in conjuction with the right to human dignity (Article 1(1) of the Basic Law for the Federal Republic of Germany). (The text of the Basic Law for the Federal Republic of Germany is available in German here and in English here).
The judgment took into account the development of technology, which, through extensive data collection, can make those affected individuals vulnerable, overly "transparent" and endanger the basic functioning of the democracy. In a democratic society, therefore, it is desirable, on the basis of the right to informational self-determination, that data relating to individuals cannot be collected, stored or used without limits.
The census ruling of the German Constitutional Court made the following main findings and set the following requirements:
- established the prohibition of unlimited data collection and established the right of individuals to decide on the disclosure and use of their own personal data (informational self-determination),
- the right to informational self-determination is not unlimited, but its limitation is only possible in cases of adequate public interest, which has a constitutional basis and meets constitutional requirements (in particular clarity), and restrictions must be proportionate,
- a distinction should be made between the processing of data collected personally (personal data) and statistical data (anonymous data), in case of the use of statistical data, strict purpose limitation is not necessary, but appropriate measures should be applied in the processing and use of data,
- although the Census Act did not violate human dignity, additional safeguards were needed to protect informational self-determination,
- certain data transfer regulations of the Census Act violated the general right to personality.
What is the significance of the judgment?
The census judgment has left its mark on the development of data protection law and data protection thinking across decades and borders. The right of informational self-determination formulated in the judgment greatly contributed to the development of the content of the second-generation data protection rules that instead of providing a technology-focused (technology-specific) regulation, ensured the right of the individual to dispose over his data.
The impact of the judgment can also be experienced in the EU data protection rules, as the previous Data Protection Directive (Directive 95/46/EC) also fell under the second generation of data protection rules, and several points of the Directive were also incorporated into the GDPR that is currently in force and applicable.
