Data Privacy Under Fire: How Mass Surveillance by German Prosecutors Threatens Your Digital Rights

The "Mikado" case originated with an investigation into child pornography hosted on the internet. German prosecutors in Halle discovered a website offering such content for sale and processed payments via credit cards. In an attempt to identify the perpetrators, they demanded that every credit card company and bank operating in Germany provide details of all accounts that had made payments to the website. This action involved the mass collection of financial data from millions of individuals, far exceeding the scope of the original investigation.

Thomas Kahler, in his dissertation, dissected the legality of the German prosecutor's actions from multiple legal angles, including constitutional law, European law, data protection law, and criminal procedure. He argued that Section 161 of the German Code of Criminal Procedure (StPO), which the prosecution cited as justification, was insufficient to warrant such a broad data collection effort. Kahler contended that neither a direct nor analogous application of Section 98a StPO, which deals with the seizure of evidence, was appropriate. He also highlighted the violation of bank secrecy and the lack of a clear legal basis for the banks' data processing activities, particularly under the now-repealed Federal Data Protection Act (BDSG a.F.).

The "Mikado" case led to the examination of financial records of 22 million accounts, with 322 "positive" matches passed on to the prosecution. This mass data collection raised significant concerns. Critics decried it as a gross violation of privacy, arguing that it set a dangerous precedent for unchecked government surveillance. The lack of transparency, as individuals whose data was collected were not informed, compounded these concerns, as did the potential for abuse of the collected data for purposes beyond the original investigation. This broad scope created a chilling effect on freedom of expression and undermined public trust in government institutions.

The German prosecutors primarily relied on Section 161 of the German Code of Criminal Procedure (StPO), which allows for information gathering, to justify their actions. However, this justification was challenged. Thomas Kahler argued that this provision was insufficient to warrant such a sweeping intrusion into privacy, especially considering it did not override the fundamental right to bank secrecy. Critics argued that Section 161 StPO, a general provision for information gathering, did not provide adequate grounds for such a wide-ranging data collection effort.

The "Mikado" case serves as a critical reminder of the challenges in balancing law enforcement needs with individual privacy rights in the digital age. It illustrates how mass data collection, without sufficient legal justification and transparency, can undermine fundamental rights. It suggests that existing legal frameworks may be inadequate to address the unique challenges posed by digital surveillance. Necessary changes include the development of clearer, more robust safeguards to protect individual privacy, ensuring transparency in data collection practices, and establishing a stronger legal basis for law enforcement activities that involve access to personal data. The introduction of GDPR reflects some of these necessary changes, particularly addressing the notification aspect.