D11.6: Survey on Mobile Identity

The legal framework for LBS in Europe LEGAL FRAMEWORK FOR PROCESSING LOCATION DATA BY PUBLIC AUTHORITIES

Legal framework for processing location data by public authorities

Law enforcement authorities have two means of accessing data on the whereabouts of a suspect. One can differentiate between access to data collected with own technical means in the cause of an investigation (generating data) and access to data collected and processed by private parties, mostly providers of telecommunications services and Location Based Services (using data). An investigation method resulting in the collection of location data is police observation by means of special technical aids. In addition, law enforcement authorities can access traffic and location data collected by telecommunications service providers. Collection of and access to location data by law enforcement authorities is regulated in the German Code of Criminal Procedure (Strafprozessordnung – StPO). Transparency for and prior consent of the data subject to be located is restricted by covert investigation methods and would generally jeopardize the success of a covert investigation. In such a case notification of the data subject is required after the investigation.

1. 1. 1. Law enforcement authorities’ access to or collection of location data

A number of German laws contain provisions concerning the location of citizens. For law enforcement authorities these include Articles 100f, 100g and 100i of the German Code of Criminal Procedure. Article 100i StPO allows the positioning of a person by means of locating the position of that person’s cell phone in order to prepare arrest by law enforcement authorities. Article 100f StPO allows the planned monitoring (observation) of suspects to criminal offences of considerable importance. An observation may be carried out employing special technical aids such as night-vision equipment, tracking systems and satellite-guided positioning systems or an IMSI-Catcher. Furthermore, according to Article 100g StPO providers of telecommunications services can be ordered to hand over traffic data necessary for the investigation of a criminal offence of considerable importance or a criminal offence committed by means of a ‘communication terminal’ (Endeinrichtung). Traffic data to be handed over includes the Cell-ID (Standortkennung) when mobile handsets are used or the termination points of fixed connections. These investigation methods require a warrant.

1. 1. 1. The Data Retention Directive and location data

Currently location data may only be processed for the duration necessary for the provision of a value-added service. A telecommunications service provider may store traffic data only up to the end of the period during which the bill may lawfully be challenged or payment pursued.  

The German transposition of the Data Retention Directive will extend the retention period to six months also for location data. In order to identify the location of the mobile equipment at the time of the communication the draft transposition law requires the retention of the location label (Cell-ID) at the beginning of a communication, both of the calling and the dialled number, Art. 110a paragraph 2 TKG-E.  

This requirement will apply to location related traffic data (Cell-ID). The provisions of Directive 2006/24/EC do not cover precise location data and also the German draft transposition law does not extend the scope of data retention to precise location data. The Data Retention Directive still allows for up to six months the retroactive reconstruction of movements. 

1. 1. 1. Radio cell query

In this context a method of investigation for German police gains a new scope and the proportionality of the directive has been questioned. Based on a warrant law enforcement authorities can obtain traffic data of all GSM subscribers who at the time a serious crime was committed were in range of the radio cell closest to the crime scene. This method of obtaining past traffic data of all individuals using a telecommunications service close to a crime scene is called radio cell query (Funkzellenabfrage) and is based on Art. 100g StPO. What data law enforcement authorities obtain has not been precisely revealed to data protection supervisory authorities. The data used for identifying these persons must contain the Cell-ID to establish the spatial linkability. Furthermore, to identify the subscriber linkability can be established by means of the MSISDN (Mobile Subscriber Integrated Services Digital Network Number), which refers to a particular mobile device. The customer data collected upon subscription allows linking the MSISDN to an identified person.

The radio cell query investigation method has been criticised as it involves innocent individuals who find themselves questioned in investigations into crimes of considerable importance. In this context the observation is crucial that once police has collected personal data the likeliness of quick deletion of data varies. Being at the wrong place at the wrong time may lead to an entry ‘questioned in the cause of a murder investigation’.

1. 1. 1. Automatic car number plate scanning

In several German states the police laws have been amended and do now contain provisions on automatic car number plate scanning. Most recently, in February 2007, the legislative assembly of the state of Schleswig-Holstein amended the state’s police law. Article 184 paragraph 5 LVwG-SH now allows automatic car number plate scanning. CCTV systems collect the number plate data and match it to a reference database of stolen cars or cars sought for another reason, for example because an arrest warrant was issued against the owner of the car. The data collected includes the number plate information, place of data collection, point of time of collection, and direction of travel. If the matching process does not result in a hit, the data must be deleted immediately. The automatic number plate scanning aims at identification and localisation of either a wanted car, a wanted owner of a car, or a wanted driver of a car. This investigation method, like the positioning of a suspect’s cell phone, is based on the assumption that the registered car owner or driver is mainly driving the car.

1. 1. 1. Electronic monitoring of convicts released on parole

The state of Hesse started testing the use of electronic bracelets for convicts in 2000 and is currently the only German state using electronic monitoring of convicts released on parole. The test merged into regular use without a complete technical evaluation. Several states have been discussing the use of electronic monitoring. The electronic monitoring in Hesse is based on Article 56 lit. c Criminal Code and in addition the consent of the convict to be monitored. The convict, when released on parole can be instructed to not visit specific areas or places and to remain at his residence for specific periods of time. Abidance is controlled by means of electronic monitoring. If the convict released on parole leaves the allowed area, his parole officer is notified via sms. The Data Protection Commissioner of Hesse voiced the opinion this current statutory basis was not sufficient. He argued electronic monitoring was comparable with supervision of conduct as laid down in Article 68 Criminal Code. The Commissioner therefore called for the introduction of a specific legal basis covering electronic monitoring.

A further law dealing with the location of citizens are the Registration Acts of the German states. German citizens are obliged to notify the municipal registration office if they change their permanent residence. The registration office keeps records which among other data hold the name of the citizen and the present and former address of his domicile. This kind of general localisation of property belonging to an identifiable person is not in the focus of this report, which looks into provisions concerning the actual whereabouts of a person at a specific point in time.