Criminal data protection law and the information society

Publication

Project manager: Prof. Dr. Beatrice Brunhöber

Project description

The increasing mechanization and digitalization of our lives means that more and more personal data is being collected. Ubiquitous computing means that all the technical devices we use, from smartphones to cars, also record and process information about us. On the other hand, it is becoming increasingly easy to collect, archive and evaluate information. The keywords here are big data and artificial intelligence. This often awakens desires for analysis beyond what is authorized and carries the risk of misuse of sensitive data.

Since the 1980s, data protection has therefore been a topic that has not only occupied public debate, but also legal scholarship. In Germany, the debate began with the protests against a planned census, the legal basis of which the Federal Constitutional Court declared partially unconstitutional in 1983. In the census ruling, the court developed the German version of a fundamental data protection right: the right to informational self-determination. Today, debates are not only dominated by criticism of state intervention, for example through data retention. The question of how to deal with private companies’ hunger for data is also increasingly coming to the fore. In jurisprudence, both problem areas have so far been discussed primarily in public law and private law. As a result, questions as to whether and to what extent the “data subject” should be protected under criminal law have so far played almost no role. The research project will close this gap.

The special feature of this subject area is that, unlike the majority of criminal law, the normative requirements for data protection under criminal law do not (or cannot) coincide with traditional values – as is the case with homicide and assault offenses, for example. This is because it is a relatively new phenomenon that is difficult to access in terms of moral or ethical values and, in view of its international dimension, is in any case exposed to a wide variety of “data cultures”. It is therefore an area in which normative orders are only just beginning to develop. The research project will examine their development in an interdisciplinary manner, so that concrete technical developments, philosophical findings as well as sociological and historical approaches can be included. In this way, social and economic analyses of the information society can be used to work out what is at stake from a legal perspective, in particular which conflicts and which claims need to be reconciled.

It is becoming apparent that data protection through criminal law is not about protecting all data from misuse or destruction, as one might think at first glance (e.g. protection against hacking of company data). If one places the topic in the context of information law and critically reconstructs the genesis of data protection, it should become clear that it is much more about protecting the individual from personal injury when third parties handle personal information.

Based on these analyses, it is possible to identify the criminal provisions that fall under data protection law. These are criminal provisions that essentially protect the right to informational self-determination. In particular, provisions that prohibit the secret recording of words and images or the disclosure of personal information must be taken into account. This ranges from the protection of the violation of patient confidentiality to the prohibition of “cyberbullying”.

The project focuses on the analysis of such “data-protecting” criminal provisions. With recourse to the aforementioned social and economic analyses, it is also necessary to examine whether there has been an over-criminalization in areas of data protection or whether criminal law protection falls short. To this end, an independent, genuinely constitutional assessment standard is developed that differs from the conventional criminal law approach. In this way, the normative purpose of the “data-protecting” criminal provisions can be worked out more clearly and the basis for a constitutionally-oriented interpretation of the criminal provisions can be laid: It is about protecting the right to self-determined handling of personality-relevant information.

The project was already started at the Humboldt University in Berlin with the habilitation thesis submitted there and incorporated into the Cluster of Excellence. The publication of the book requires extensive updates and additions because developments are rushing ahead in both technical and legal terms, as shown, for example, by the fact that the European General Data Protection Regulation has now come into force. The publication of the book will be accompanied and supplemented by a series of events at Goethe University on “Digitalization and Law”.

Publication:
Beatrice Brunhöber, Der strafrechtliche Schutz der informationellen Selbstbestimmung, Mohr Siebeck Verlag, series “Jus Poenale”, Tübingen, probably 2020 (forthcoming).

Event:
Series of events together with Prof. Dr. Indra Spiecker gen. Döhmann at the Goethe University Frankfurt: “Digitalization and Law” probably in the summer semester 2020 (The series will be postponed!)