Privacy advocates in the UK sometimes look across at Germany in wistful admiration – but is the story quite as rosy for privacy in Germany as it sometimes appears? Perhaps not, for though one recent event has shown Germany in its best light, as a beacon for privacy rights across Europe, another has demonstrated the opposite. Even Germany has an ugly side to how it deals with privacy.
First for the good. As reported widely (and in this case in out-law.com), this last week Germany’s highest court has suspended that country’s implementation of the EU Data Retention Directive by ruling that it violates citizens’ rights to privacy. This suspension comes after a class action suit brought by 35,000 German citizens – a level of citizen activity that would be close to miraculous in the UK, particularly for as issue such as privacy. The law by which the German government implemented the Data Retention Directive has been found unconstitutional, failing to include enough safeguards for the privacy of the individuals that is required under Germany’s constitution. A victory for privacy, albeit neither a complete nor a permanent one, since the court did not say that it would be impossible to implement the Data Retention Directive in a constitutionally acceptable way, just that this particular implementation was unconstitutional. Nonetheless, it is something about which German privacy advocates will feel justifiably proud – and many in other countries in Europe will hope signals changes elsewhere. It is hard to imagine, however, that it will be possible to achieve a similar result in the UK.
Then for the bad – or at least the ugly. A story reported far less widely, at least in the UK, is emerging concerning the German government’s use of data concerning the use by German citizens of Swiss banks for the purposes of tax evasion. This data has been acquired through various methods, most of which would probably be considered illegal – certainly from the perspective of the Swiss banks. Reuters has reported on the subject – it is a somewhat complex story, but the essence of it is that private data, detailing the banking activities of German citizens, has been offered for sale to a number of German states. Some of that data may have come from insider whistle-blowers, but some has also come from hackers – and earlier this year the German Federal Government gave states the go-ahead to buy the data if they want, whether or not the data has been obtained illegally. At least one state, the State of North Rhine-Westphalia, has bought the data, and is using it to flush out tax evaders. As Reuters reports, nearly 6,000 German tax evaders have ‘owned up’ to the tax evasion as a result of this evidence – and more could still be about to come out of the woodwork. As DSTG head Dieter Ondracek said, “If we get a signal from the politicians that it’ll only be possible for people to come clean this year, then we could have another 5,000 doing so with corresponding additional revenues,” Ondracek told Reuters. “Then a billion euros could be possible.”
This is not the first time that Germany has bought illegally acquired private data. Two years ago, something similar happened with bank data from Lichtenstein, effectively forcing the principality to relax its previously stringent bank secrecy laws. The current affairs over Swiss banking data might have a somewhat similar effect over the banking rules in Switzerland, though that of course could be a long way away – though already the Swiss have complied with a US request over tax evasion, and as reported in Reuters, Switzerland’s justice minister questioned on Sunday whether tax evasion should continue to be treated as a misdemeanour rather than a crime.
It is hard, of course, to generate much sympathy for people evading tax through the use of bank accounts in Switzerland – but that should not blind us to the significance of the events that are taking place. It’s not so much the nature of the data that’s significant, but the way in which is has been acquired. Getting data through the use of official requests from one government to another, as in the case of the US, is one matter, but paying money for data acquired illegally, and quite likely through hacking, is quite another, and sets a very uncomfortable precedent. Moreover, it provides a new and potentially large incentive to hackers to go after this kind of data. And if this kind of data, why not other data? Aside from the obvious problems of Germany’s potential obligations as a signatory of the Cybercrime Convention, there is an awkward parallel here with another recent event – the enormously publicised hacking of the gmail accounts of Chinese dissident groups. The Chinese government of course vigorously denies any involvement in the hack, but if it were to be offered data on illegal groups acquired by hacking, how different would it be for the Chinese government to buy it from the German government’s buying of this Swiss banking data?
From the perspectives of the two governments, they’re just seeking to root out people involved in illegal activities – for the Germans, tax evaders, for the Chinese, people involved in subversive (and illegal) activities. And in both cases, the fact that it might be possible to make money from selling this kind of data cannot help but be an incentive to try to acquire it. People in the West may have much more sympathy for Chinese dissidents than they do for German tax-evaders, but in some ways the principles are very much the same. Do we really want to set that kind of precedent?
Paul Bernal's Blog 