State criminal office in Mecklenburg-Vorpommern purchased location data from apps – experts see breach of law
At least two German state criminal offices have used commercially traded smartphone location data for investigations. Experts consider this unlawful.
German police authorities used purchased mobile phone location data – without clear legal basis
The State Criminal Office (LKA) Mecklenburg-Vorpommern deployed location data from smartphone apps in investigations, data originating from the advertising industry. This is reported by tagesschau.de based on joint research with netzpolitik.org. It is the first time a German law enforcement authority has officially confirmed the use of commercially traded location data.
The LKA stated in response to enquiries that this had occurred "in the past in limited scope". The authority relies on the general investigative authority under the Code of Criminal Procedure and the State Police Act as its legal basis. The Brandenburg LKA also acknowledged using services from data dealers in order to "combat various criminal phenomena". Whether this also includes location data, the authority left open.
Data from the advertising industry for law enforcement
Location data from apps is typically collected for advertising purposes. Users who activate location functionality for apps thereby disclose movement information that can end up with data dealers. In the EU, the sale of such data without explicit user consent is prohibited – but according to the research, this apparently does not deter dealers from offering movement profiles from Germany and other EU countries on a large scale.
Worldwide there are providers who process this data for law enforcement authorities. According to a report by the Citizen Lab at the University of Toronto, the Hungarian police are among their customers. According to media reports, the US immigration authority ICE is also said to use the tool to determine the whereabouts of individuals who are to be arrested.
Expert: incursion into fundamental rights without legal basis
Mark Zöller, professor of criminal law and digitalisation at LMU Munich, considers the use unlawful. "This location data was not created to be used by the police for hazard prevention or law enforcement," said Zöller. The use constituted a change of purpose and thus an infringement of the fundamental right to informational self-determination. Specific statutory provisions in the security laws of the federal government and the Länder have so far been lacking.
"Whoever is doing this at the moment is acting without legal basis," said Zöller. He describes a recurring pattern: "We see very frequently that police authorities recognise new technical possibilities and then forge ahead, because the temptation to use something like that is great."
Majority of LKAs remain silent
The Bavarian Broadcasting Corporation (BR) and netzpolitik.org surveyed all 16 state criminal offices on whether they use data from dealers and on what legal basis. The LKAs of Baden-Württemberg, Bavaria, Hamburg, North Rhine-Westphalia, Saarland, Saxony, Saxony-Anhalt and Thuringia stated that the use of commercially available location data was legally fundamentally possible. The LKAs of Bremen, Hesse, Rhineland-Palatinate and Schleswig-Holstein stated that they do not use such data.
Nine authorities refused to provide any information, citing security classification or police tactical grounds. "In order to effectively protect the effectiveness of law enforcement and hazard prevention and not to endanger ongoing proceedings, this information must be treated confidentially," wrote, for example, the Saxon LKA. Bavaria, Berlin, North Rhine-Westphalia and the Saarland also left open whether they use commercial location data.
For Zöller, this reluctance is telling: "That suggests that it is at least being considered there as well." An opinion by the Bundestag's Scientific Service from the previous year had already concluded that there were indications that "the practice does not constitute an exceptional phenomenon, but is increasingly becoming part of official information management".
Data protection authorities see no sound legal basis
All 16 state data protection commissioners were also surveyed by BR and netzpolitik.org. None of the authorities could cite a specific legal basis for police use of commercial location data. The state data protection commissioner of Brandenburg stated that investigative general clauses, on which several LKAs rely, "cannot in our view be used as the basis for the collection and use of commercial location data".
The state data protection commissioner of Mecklenburg-Vorpommern, Sebastian Schmidt, warned against deliberate circumvention of judicial oversight. Measures such as cell site queries, in which police retrieve mobile phone data from mobile operators, must generally be ordered by a court. "And one would circumvent such a judicial reservation if one used commercial location data without having a corresponding legal basis for it," said Schmidt.
The research thus reveals that German police authorities are operating in a legal grey area – and that a nationwide uniform statutory regulation has so far been lacking.
Source: Google News DE — Crime (de)