German Court Restricts Police Use of Spyware
Germany’s highest court ruled that law enforcement cannot deploy spyware to monitor personal devices in investigations where the maximum sentence is under three years. The decision followed a lawsuit by Digitalcourage, a German digital freedoms organization, challenging a 2017 amendment to the criminal procedure code. Plaintiffs argued the 2017 change allowed spyware to eavesdrop on encrypted chats and messaging platforms without sufficient safeguards, potentially exposing communications of people who are not suspects.
The court found the 2017 law lacked the necessary precision about when spyware may be used and held that such intrusive measures are only permissible in investigations of serious crimes. The ruling emphasized that spyware constitutes a “very severe interference” with fundamental rights. Because spyware can capture and analyze all raw data exchanged on a device, the court noted its exceptional reach given modern information technology and the central role of digital communication in people’s lives.
The decision imposes stricter legal limits on law enforcement’s technical surveillance powers, reinforcing the requirement that interference with private communications must be lawful, necessary, and proportionate. It aligns with broader data protection principles under EU law, which demand clear legal bases and safeguards when processing sensitive personal data, especially where covert interception is involved.
Digitalcourage welcomed the ruling as a protection of privacy and digital freedoms, while law enforcement agencies will need to adjust practices and seek legal frameworks that meet the court’s standards for precision and proportionality. The judgment is likely to prompt legislative review and could influence how other EU member states regulate use of spyware for criminal investigations.
