BVerwG - 6 A 2.24
From GDPRhub
| BVerwG - 6 A 2.24 | |
|---|---|
 | |
| Court: | BVerwG (Germany) |
| Jurisdiction: | Germany |
| Relevant Law: | Article 2(2)(a) GDPR Article 58 GDPR § 16(2) BDSG |
| Decided: | 04.03.2026 |
| Published: | |
| Parties: | Bundesbeauftragte für den Datenschutz und die Informationsfreiheit (BfDI) Bundesnachrichtendienst (BND) |
| National Case Number/Name: | 6 A 2.24 |
| European Case Law Identifier: | ECLI:DE:BVerwG:2026:040326U6A2.24.0 |
| Appeal from: | |
| Appeal to: | Unknown |
| Original Language(s): | German |
| Original Source: | BVerwG (in German) |
| Initial Contributor: | ap |
A court dismissed the federal DPA’s lawsuit regarding its information request rejected by the Federal Intelligence Service concerning the processing of foreign data subject’s communications. According to the court, the DPA lacked standing under national law since the respective processing was outside the scope of the GDPR.
English Summary
Facts
In 2024 the federal Data Protection Authority (Bundesbeauftragte für den Datenschutz und die Informationsfreiheit, or BfDI) requested access from the Federal Intelligence Service (BND, the controller), to ensure that their activities complied with data protection law. The request related to the controller’s processing of foreign data subject’s communications. The controller refused this request on the grounds that the Independent Supervisory Board (UKR) had exclusive jurisdiction to review the case. The BfDI filed a complaint with the Federal Chancellery (the highest federal authority responsible for the controller), who rejected the claim.
The BfDI brought a case to the Federal Administrative Court. The BfDI requested the court to order the controller to provide access, or alternatively, to declare that the controller violated the BfDI’s right to access under national law. On the other hand, the controller requested the court to dismiss the case.
Holding
The court dismissed the claim on procedural grounds, stating that the BfDI did not have standing under national law. The court dismissed both claims of access and declaratory judgment. The court dismissed the BfDI’s argument regarding its standing based on a constitutional requirement for effective supervisory control. The court drew a distinction between the BfDI invoking a subjective public right as a public authority in comparison to a citizen.
The court first clarified that this case falls outside of the scope of the GDPR, in accordance with Article 2(2)(a) GDPR. In these situations, national law provisions did not allow the BfDI to directly intervene against the controller for the purpose of data protection oversight. Instead, the BfDI must file a complaint with the competent supreme federal authority. This limitation must not be circumvented through the court proceedings. The court considered that the BfDI has sufficient powers to contribute to remedying situations it deems unlawful by raising an objection to the Federal Chancellery. This authority has similar powers under national law as those outlined in Article 58(1) to (3) GDPR.
Comment
Share your comments here!
Further Resources
Share blogs or news articles here!
English Machine Translation of the Decision
The decision below is a machine translation of the German original. Please refer to the German original for more details.
Judgment In the administrative dispute, the Sixth Senate of the Federal Administrative Court in the oral hearing of March 4, 2026, with the presiding judge of the Federal Administrative Court, Prof. Dr. Kraft, and judges of the Federal Administrative Court, Dr. Möller and Hahn, as well as judges of the Federal Administrative Court, Dr. Gamp and Hellmann, rendered the following judgment: The action is dismissed. The plaintiff shall bear the costs of the proceedings. Reasons I 1. The plaintiff, the Federal Commissioner for Data Protection and Freedom of Information (BfDI), seeks from the defendant, the Federal Intelligence Service (BND), access to the orders issued by the President of the BND pursuant to Section 37 Paragraph 1 of the Federal Intelligence Service Act (BNDG) for individual intelligence measures under Section 34 of the BNDG. 2 Pursuant to Section 34 Paragraph 1 Sentence 1 of the Federal Intelligence Service Act (BNDG), the BND is authorized, in order to fulfill its tasks, to intervene in information technology systems used by foreigners abroad using technical means, without the knowledge of the data subject, based on an individual intelligence-gathering measure previously ordered by the President of the BND pursuant to Section 37 Paragraph 1 of the BNDG, and to collect personal data stored on these systems, including the content and circumstances of ongoing communications, insofar as this is necessary for specified purposes (in particular in the form of so-called Computer Network Exploitation (CNE) measures). 3 Until 2023, the BND stored the personal data it had obtained through CNE measures in the file "S.". Although this file has not been used for processing data from new CNE measures since then, the data processed in it at that time is still at least partially held by the BND and continues to be processed by it. Furthermore, large quantities of related log data still exist. 3 4 In December 2023 and January 2024, the plaintiff's predecessor in office requested access to the orders issued by the President of the BND pursuant to Section 37 Paragraph 1 of the BNDG, which formed the basis for the measures carried out with the "S." file from its commissioning until June 1, 2023, pursuant to Section 34 of the BNDG, for the purpose of monitoring the BND's compliance with data protection regulations as described in Section 63 of the BNDG in conjunction with Section 28 Paragraph 2 Sentence 1 of the Federal Constitutional Court Act (BVerfSchG). The BND refused access, arguing, among other things, that the Independent Control Council (UKR) was exclusively responsible for reviewing the legality of the aforementioned orders pursuant to Section 37 Paragraph 4 of the BNDG. Subsequently, on March 22, 2024, the plaintiff's predecessor in office objected to the Federal Chancellery, as the supreme federal authority responsible for the BND, pursuant to Section 64 No. 1 Letter a of the Federal Intelligence Service Act (BNDG) in conjunction with Section 16 Paragraph 2 of the Federal Data Protection Act (BDSG), regarding the refusal of access and requested a statement from the Federal Chancellery. The Federal Chancellery rejected the objection in its statement of April 11, 2024. 5 The plaintiff's predecessor in office filed a lawsuit on May 22, 2024. On September 3, 2024, the plaintiff was appointed Federal Commissioner for Data Protection and Freedom of Information (BfDI). 6 She argues that Section 63 of the Federal Intelligence Service Act (BNDG) restricts her access to the BND's files. Pursuant to Section 28 Paragraph 3 Sentence 2 Number 1 of the Federal Constitutional Court Act (BVerfSchG), the Federal Intelligence Service (BND) is granted a right of access as a legally enforceable position in administrative proceedings under Section 42 Paragraph 2 of the Code of Administrative Court Procedure (VwGO). Its status as an authority and the fact that it and the BND share the same legal entity (the defendant) do not preclude this. Due to its independence and freedom from instructions guaranteed by Section 10 of the Federal Data Protection Act (BDSG), it is separate from the hierarchical organizational structure of the defendant. There is no body that is superior to both it and the BND and can make binding decisions in disputes. Insofar as Section 64 Number 1 Letter a of the Federal Intelligence Service Act (BNDG) in conjunction with Section 16 Paragraph 2 of the BDSG stipulates that it can only issue a complaint within the framework of data protection oversight of the BND, this applies only to the complaint of a data protection violation that is made at the end of an oversight procedure. The plaintiff's right of access to information, asserted during the course of a review procedure under Section 63 of the Federal Intelligence Service Act (BNDG) in conjunction with Section 28 Paragraph 3 Sentence 2 No. 1 of the Federal Constitutional Court Act (BVerfSchG), must be a legally enforceable position in administrative proceedings if supervisory oversight is not to be effectively at the disposal of the intelligence services being reviewed and the supreme federal authorities superior to them. Particularly in the sensitive field of intelligence services, there is a fundamental right to effective supervisory oversight. This right, which the plaintiff's right of appeal to potentially affected parties under Section 63 of the BNDG in conjunction with Section 28 Paragraph 1 of the BVerfSchG serves, argues in favor of the judicial enforceability of the plaintiff's right of access. 7. On the merits, the plaintiff's request for access to the disputed orders of the President of the BND pursuant to Section 37 Paragraph 1 of the BNDG is justified under Section 63 of the BNDG. The authority to monitor compliance with data protection regulations at the Federal Intelligence Service (BND) is based on Section 28 Paragraph 3 Sentence 2 Number 1 of the Federal Constitutional Court Act (BVerfSchG). Its competence under Section 63 of the Federal Intelligence Service Act (BNDG) in conjunction with Section 28 Paragraph 2 Sentence 1 of the BVerfSchG is, according to Section 58 Paragraph 4 of the BNDG, neither excluded nor limited with regard to the aforementioned orders by the supervisory function of the quasi-judicial supervisory body of the UKR pursuant to Section 37 Paragraph 4 of the BNDG nor by that of the administrative supervisory body of the UKR pursuant to Section 51 of the BNDG. 8 The plaintiff requests that the defendant be ordered to grant the plaintiff access to the orders pursuant to Section 37 of the BNDG, which pertain to the file "S." The plaintiff seeks a ruling that the measures taken pursuant to Section 34 of the Federal Intelligence Service Act (BNDG) up to June 1, 2023, are based on the following: Alternatively: that the defendant violated the plaintiff's right of access under Section 28 Paragraph 3 Sentence 2 No. 1 of the Federal Constitutional Court Act (BVerfSchG) in conjunction with Section 63 of the Federal Intelligence Service Act (BNDG) by refusing to grant her access to the orders pursuant to Section 37 of the Federal Intelligence Service Act (BNDG) that form the basis for the measures taken with the file "S." up to June 1, 2023, pursuant to Section 34 of the Federal Intelligence Service Act (BNDG). 9 The defendant requests that the action be dismissed. 10 The defendant argues that the pending proceedings constitute a self-dealing action, which is inadmissible due to the plaintiff's lack of a legally enforceable position under Section 42 Paragraph 2 of the Code of Administrative Court Procedure (VwGO). The action was also unfounded, since the legislature had established the UKR (Federal Intelligence Service) as the primary supervisory body for the oversight of the BND's technical intelligence activities. 11 By order of October 29, 2025, the Senate, pursuant to Section 173 of the Administrative Court Procedure Act (VwGO) in conjunction with Section 280 Paragraph 1 of the Code of Civil Procedure (ZPO), ordered a separate hearing on the admissibility of the action. 12 For further details of the facts and the submissions of the parties, reference is made to the court file, the documents submitted by the parties, and the BND's administrative file. 11 II 13 The action brought before the Federal Administrative Court, which has jurisdiction in the first and last instance pursuant to Section 50 Paragraph 1 No. 4 of the Code of Administrative Court Procedure (VwGO), is inadmissible for lack of standing under Section 42 Paragraph 2 VwGO (by analogy), both with respect to the primary claim for performance (1.) and the alternative claim for declaratory relief (2.). 14 1. With her action for performance, the plaintiff seeks to enforce her claim under Section 63 BNDG in conjunction with Section 28 Paragraph 3 Sentence 2 No. 1 of the Federal Constitutional Court Act (BVerfSchG) to inspect the orders issued by the President of the BND pursuant to Section 37 Paragraph 1 BNDG that underlie the measures taken under Section 34 BNDG, in order to review the processing of personal data carried out by the Federal Intelligence Service (BND) in the file "S." The plaintiff does not have a legally enforceable position in this case according to the provision of Section 42 Paragraph 2 of the Code of Administrative Court Procedure (VwGO), which is applicable by analogy to general performance actions (a.), and from whose provisions relating to legal disputes between public authorities (b.) the legal dispute to be decided is not expressly excluded by a procedural provision (c.). 15 a. Standing to sue within the meaning of Section 42 Paragraph 2 VwGO is not only a prerequisite for the admissibility of the actions for annulment and actions for performance designated in Section 42 Paragraph 1 VwGO. According to the established case law of the Federal Administrative Court, Section 42 Paragraph 2 VwGO applies analogously to general performance actions. The standing to sue in such a case brought by a citizen against a public authority exists if the plaintiff claims to have been violated in their subjective public rights by an administrative action or its omission, and if, according to their submissions, the violation of these rights appears possible (Federal Administrative Court, judgments of April 5, 2016 – 1 C 3.15 – BVerwGE 154, 328 para. 16 and of November 25, 2020 – 6 C 7.19 – BVerwGE 170, 345 para. 24). 16 b. In the present case, however, it is not a citizen who is challenging a public authority on the grounds of a subjective public right. Rather, the plaintiff, a supreme federal authority pursuant to Section 8 para. 1 sentence 1 of the Federal Data Protection Act (BDSG), is bringing an action based on Section 63 of the Federal Intelligence Service Act (BNDG). The plaintiff, in a lawsuit based on Section 28 Paragraph 3 Sentence 2 Number 1 of the Federal Constitutional Court Act (BVerfSchG), is challenging the Federal Intelligence Service (BND), a higher federal authority within the purview of the Federal Chancellery according to Section 1 Paragraph 1 Sentence 1 of the Federal Intelligence Service Act (BNDG). Assignments of tasks to and responsibilities of public authorities – hereinafter referred to as their powers – are, subject to an exceptionally established fundamental rights status (cf. regarding the general requirements for such status: Federal Administrative Court, Judgment of July 15, 2020 – 6 C 6.19 – BVerwGE 169, 177, paragraphs 16 et seq.), not rights within the meaning of Article 19 Paragraph 4 of the Basic Law (GG), so that their judicial enforcement is not constitutionally guaranteed. However, they can nevertheless constitute rights within the meaning of Section 42 Paragraph 2 of the German Administrative Court Procedure Act (VwGO) – irrespective of the scope of the concept of subjective public rights – if the legal system grants individual public authorities independent legal positions that are intended to be enforceable against other public authorities in the event of conflict. Such enforceable legal positions differ from subjective public rights insofar as they are not an expression of individuality and personhood, but are characterized by their orientation towards the common good (for the whole: Federal Administrative Court, judgments of September 27, 2018 – 7 C 23.16 – Buchholz 451.224 § 17 KrWG No. 3 para. 14 and of February 28, 2019 – 3 A 5.16 – BVerwGE 165, 14 para. 17). 17 c. The plaintiff is not exempt from fulfilling the requirements for a judgment on the merits under Section 42(2) of the Code of Administrative Court Procedure (VwGO) by a procedural exception (Section 42(2) VwGO: "Unless otherwise provided by law..."). Such a statutory exemption of a public authority from the requirements of Section 42 Paragraph 2 of the Administrative Court Procedure Act (VwGO) (cf. on this terminology: Federal Administrative Court, judgments of June 21, 1974 - 4 C 17.72 - BVerwGE 45, 207 <210> and of September 25, 1992 - 8 C 16.90 - juris para. 9), as it exists - albeit not for the performance situation at issue here, but for an action for annulment - for example in the form of Article 78 GDPR (on this: Federal Administrative Court, judgment of March 20, 2024 - 6 C 8.22 - BVerwGE 182, 11 para. 14), Section 35 Paragraph 2 of the Compulsory Military Service Act (WPflG a. The authority to act as a public authority, as defined in Section 63 of the Federal Intelligence Service Act (BNDG) in conjunction with Section 28 Paragraph 3 Sentence 2 No. 1 of the Federal Constitutional Court Act (BVerfSchG), is not present with regard to the authority claimed by the plaintiff under Section 63 BNDG in conjunction with Section 28 Paragraph 3 Sentence 2 No. 1 BVerfSchG. 18 d. The prerequisites under which a legally enforceable position of a public authority can be assumed in substantive terms pursuant to Section 42 Paragraph 2 of the Code of Administrative Court Procedure (VwGO) (aa.) are not present for the authority under Section 63 BNDG. The requirements of Section 28 Paragraph 3 Sentence 2 No. 1 of the Federal Constitutional Court Act (BVerfSchG), which the plaintiff seeks to enforce by way of legal action, are not met (bb.). 19 aa. For the examination of whether, with regard to an administrative authority—here Section 63 of the Federal Intelligence Service Act (BNDG) in conjunction with Section 28 Paragraph 3 Sentence 2 No. 1 of the Federal Constitutional Court Act (BVerfSchG)—a sovereign authority has a legally enforceable substantive position pursuant to Section 42 Paragraph 2 of the Code of Administrative Court Procedure (VwGO), neither general descriptive terms (aaa.) nor individual specific characteristics of a legal position can be relied upon (bbb.). The decisive factor is whether, based on an interpretation of the provision granting the authority, a legally enforceable position of the authorized sovereign authority can be inferred (ccc.). 20 aaa. No legal consequences can be derived from the concept of an internal process, which is frequently used to describe constellations such as the one at hand. Contrary to initial statements to the contrary in its early case law (Federal Administrative Court, Judgment of February 14, 1969 - 4 C 215.65 - BVerwGE 31, 263 <267>), the Federal Administrative Court soon ruled that federal law does not contain a general principle that self-dealing proceedings are inadmissible without exception (Federal Administrative Court, Judgment of June 21, 1974 - 4 C 17.72 - BVerwGE 45, 207 <209 f.>). Rather, such a proceeding is neither permitted nor excluded for its own sake; the decisive factor is the circumstances of each individual case (Federal Administrative Court, Judgment of November 6, 1991 - 8 C 10.90 - NJW 1992, 927). (Federal Administrative Court, Judgment of June 21, 1974 - 4 C 17.72 - BVerwGE 45, 207 <209 f.>) 21 The term "inter-organ dispute" in administrative law or administrative procedural law is also meaningless in itself. This is true at least when it is understood—as the plaintiff argues—in a broad sense and not limited to disputes within the internal sphere of a legal entity under public law, in which—as in a municipal corporation, in particular—a pluralistically structured decision-making process takes place (in this restricted sense, for example: Wahl/Schütz, in: Schoch/Schneider, VwGO, as of July 2025, § 42 para. 2 nos. 91, 94, 102; R. P. Schenke, in: Kopp/Schenke, VwGO, 31st ed. 2025, § 42 no. 80). The present case does not concern an inter-organ dispute in such a narrow, meaningful sense. 22 bbb. Contrary to the plaintiff's view, the plaintiff's independence and freedom from instructions under Section 10 Paragraph 1 of the Federal Data Protection Act (BDSG) are irrelevant to the question of the enforceable legal position she asserts in the present constellation. While the Federal Administrative Court has acknowledged in its jurisprudence that the freedom from instructions of an administrative body whose decision is challenged can give rise to a need for an enforceable legal position on the part of the challenging—usually superior—body (Federal Administrative Court, Judgment of June 21, 1974 - 4 C 17.72 - BVerwGE 45, 207 <209>), in the present case the objective of the procedural challenge is not a decision by the independent and free plaintiff. Rather, the plaintiff's action is directed against the refusal of access to information by the Federal Intelligence Service (BND), which is by no means independent and free from instructions. The Federal Administrative Court has indeed considered that the freedom from instructions of an administrative body whose decision is challenged can give rise to a need for an enforceable legal position on the part of the challenging—usually superior—body (Federal Administrative Court, Judgment of June 21, 1974 - 4 C 17.72 - BVerwGE 45, 207 <209>). 23 The plaintiff is further mistaken in her assertion that she can base the assumption of a legally enforceable position on the fact that there is no superior authority to both herself and the BND with the power to decide disputes. The fact that such an authority exists with regard to the public authorities involved in a legal dispute can preclude the need for legal protection of the public authority bringing the action. For the question of standing to sue pursuant to Section 42 Paragraph 2 of the Code of Administrative Court Procedure (VwGO), this circumstance is irrelevant (see Federal Administrative Court [BVerwG], judgments of September 25, 1992 - 8 C 16.90 - juris para. 11 and of March 28, 1996 - 7 C 35.95 - BVerwGE 101, 47 <48 ff.>; similarly: Federal Administrative Court [BVerwG], judgment of November 6, 1991 - 8 C 10.90 - NJW 1992, 927; in contrast, Higher Administrative Court [OVG] Bautzen, decision of September 25, 1998 - 3 S 379/98 - NJW 1999, 2832 <2834>). ... 24 ccc. According to the case law of the Federal Administrative Court, in the context of legal actions brought by public authorities against other public authorities – whether they are those with the same legal entity or those with different legal entities – based on powers vested in them, the competence norms invoked by the respective plaintiffs must be examined to determine whether they confer upon them a defensible legal position. The applicable standards are comparable to those that apply in connection with a citizen's action against a public authority when examining the protective nature of a provision alleged to have been violated (cf. fundamentally, in the relationship between public authorities and different legal entities: Federal Administrative Court, judgments of September 27, 2018 - 7 C 23.16 - Buchholz 451.224 § 17 KrWG No. 3 para. 14 et seq. and of February 28, 2019 - 3 A 5.16 - BVerwGE 165, 14 para. 17 et seq., 27 et seq.; in substance, already previously in the relationship between public authorities and the same legal entity: Federal Administrative Court, judgment of June 21, 1974 - 4 C 17.72 - BVerwGE 45, 207 <209). f.>). 25 bb. The provision of Section 63 of the Federal Intelligence Service Act (BNDG) in conjunction with Section 28 Paragraph 3 Sentence 2 No. 1 of the Federal Constitutional Court Act (BVerfSchG), on which the plaintiff bases its claim for the right of access pursued in its action, does not provide the necessary standing to sue. The wording of the provision is unhelpful in this regard (aaa.). The systematic interpretation of the law and the interpretation oriented towards the legislator's intent argue decisively against granting the plaintiff a standing to sue derived from the provision. According to this interpretation, the plaintiff can only respond to a violation of the provision—such as the data protection violations by the BND that it has identified—by issuing a formal complaint to the Federal Chancellery, the highest federal authority responsible for the BND, and requesting a statement, but cannot directly take action against the BND by issuing an administrative act (bbb.). The plaintiff lacks the authority to directly intervene in the BND's affairs, not only with regard to the conclusion of, but also throughout the entire course of, any proceedings initiated by the plaintiff concerning the BND's data protection oversight (ccc). The statutory limitations on the plaintiff's powers vis-à-vis the BND must not be circumvented by granting the plaintiff the asserted enforceable legal position. This interpretation of the law does not conflict with constitutional requirements (ddd.). 26 aaa. The wording of Section 63 of the Federal Intelligence Service Act (BNDG) in conjunction with Section 28 Paragraph 3 Sentence 2 No. 1 of the Federal Constitutional Court Act (BVerfSchG) does not, in the absence of an express provision, indicate that the plaintiff is granted an enforceable legal position to enforce this authority beyond its administrative power of access. This is all the more true since, even when the legislator refers to the plaintiff's rights vis-à-vis the BND—as in Section 58 Paragraph 4 of the Federal Intelligence Service Act (BNDG)—he ultimately means "only" the plaintiff's powers (cf. Section 58 Paragraph 2 Sentence 2 of the BNDG draft: Bundestag Printed Paper 19/26103, p. 115). 27 bbb. The fact that Section 63 of the BNDG in conjunction with Section 28 Paragraph 3 Sentence 2 No. 1 of the Federal Constitutional Court Protection Act (BVerfSchG) does not grant the plaintiff the legally enforceable position she claims is evident from the systematic legal relationship between this provision and the regulation contained in Section 64 No. 1 Letter a of the BNDG in conjunction with Section 16 Paragraph 2 of the Federal Data Protection Act (BDSG) ((1)), and the legislative intent underlying that regulation ((2)). 28 (1) Section 16(2), first sentence, of the Federal Data Protection Act (BDSG) stipulates that if the plaintiff identifies violations of the Federal Data Protection Act or other data protection regulations, or other deficiencies in the processing or use of personal data, in connection with data processing by federal public bodies for purposes outside the scope of the General Data Protection Regulation (GDPR), it must raise this objection with the competent supreme federal authority and request a statement from that authority within a specified period. The plaintiff does not have directly enforceable powers against the federal public bodies it monitors. 29 Section 16(2) of the German Federal Data Protection Act (BDSG) is essentially the counterpart to Section 16(1) BDSG, which, within the scope of application of the directly applicable General Data Protection Regulation (GDPR), comprehensively refers to the investigative, remedial, sanctioning, authorising, and advisory powers of the plaintiff provided for in Article 58(1) to (3) GDPR and contains supplementary procedural rules for these powers in accordance with Article 58(4) GDPR (Bange, in: Kühling/Buchner [eds.], GDPR - BDSG, 4th ed. 2024, Section 16 BDSG, para. 4 et seq.; Meltzian, in: Wolff/Brink/v. Ungern-Sternberg [eds.], BeckOK Datenschutzrecht, as of February 1, 2026, Section 16 BDSG, para. 1 et seq.). 30 In light of the legal background that the BND is subject to Article 2(2)(a) GDPR and Recital 16 to this Regulation, Pursuant to Article 4(2), third sentence, of the Treaty on the Functioning of the European Union (TFEU), Section 64 No. 1(a) of the Federal Intelligence Service Act (BNDG) stipulates that Section 16(2) of the Federal Data Protection Act (BDSG) applies when the BND performs its tasks under Section 1(2) BNDG, whereas it expressly excludes the applicability of Section 16(1) BDSG. [Note: The text appears to be a separate, unrelated sentence fragment and is omitted from the translation.] 31 According to this normative structure, it is clear that the plaintiff has no further powers at her disposal, since her predecessor, in his assessment of the BND's violation of Section 63 of the Federal Intelligence Service Act (BNDG) in conjunction with Section 28 Paragraph 3 Sentence 2 Number 1 of the Federal Constitutional Court Act (BVerfSchG), exercised the measure of objection provided for in Section 64 Number 1 Letter a of the BNDG in conjunction with Section 16 Paragraph 2 of the Federal Data Protection Act (BDSG) by letter dated March 22, 2024, requesting a statement from the Federal Chancellery, the highest federal authority responsible for the BND, and the Federal Chancellery rejected the objection in its statement of April 11, 2024. 32 (2) The exclusion of the plaintiff's power of intervention within the scope of Section 64 Number 1 Letter a of the BNDG in conjunction with Section 16 Paragraph 2 of the Federal Data Protection Act (BDSG) is not justified. The interpretation of Section 16 Paragraph 2 of the German Federal Data Protection Act (BDSG) corresponds to the clear intention of the legislator (cf. in this sense only: Bange, in: Kühling/Buchner [eds.], GDPR - BDSG, 4th ed. 2024, Section 16 BDSG, marginal notes 23 et seq.; Meltzian, in: Wolff/Brink/v. Ungern-Sternberg [eds.], BeckOK Data Protection Law, as of February 1, 2026, Section 16 BDSG, marginal notes 6 et seq.; Thiel, in: Gola/Heckmann [eds.], GDPR - BDSG, 3rd ed. 2022, Section 16 BDSG, marginal notes 7 et seq.). The legislative materials for Section 16 Paragraph 2 of the Federal Data Protection Act (BDSG) state, with regard to intelligence service data processing taking place outside the scope of the General Data Protection Regulation (GDPR), that the Federal Commissioner for Data Protection and Freedom of Information (BfDI) has sufficient powers at their disposal, including the instrument of objection known from Section 25 of the former BDSG, the warning (provided for in Section 16 Paragraph 2 Sentence 4 BDSG), and other options not requiring regulation, to draw the attention of the controller, who is bound by law as a public body, to data processing activities that they consider unlawful and thus contribute to remedying these unlawful situations. The legislature remains free to further develop the powers mentioned in Section 16 Paragraph 2 BDSG in specific security authority regulations and, if necessary, to add enforcement powers (Bundestag Printed Matter 18/11325, p. 88). With regard to the BND, this has not occurred—unlike, for example, in Section 69 Paragraph 2 of the Federal Criminal Police Office Act (BKAG) with regard to the Federal Criminal Police Office. 33 ccc. The plaintiff's view that she is only limited, at the end of a data protection review of the BND pursuant to Section 64 No. 1 Letter a of the Federal Intelligence Service Act (BNDG) in conjunction with Section 16 Paragraph 2 of the Federal Data Protection Act (BDSG), to raising an identified violation by way of a complaint to the Federal Chancellery, but must be able to enforce, through legal action, access to information requested during a review procedure pursuant to Section 63 of the BNDG in conjunction with Section 28 Paragraph 3 Sentence 2 No. 1 of the Federal Constitutional Court Act (BVerfSchG), even against the will of the BND, is untenable. The legislative decision to allow access via Section 64 No. 1 Letter a of the BNDG in conjunction with Section 28 Paragraph 3 Sentence 2 No. 1 of the BVerfSchG is not permissible. The exclusion of the plaintiff's influence on the BND's data processing activities beyond that provided for in Section 16 Paragraph 2 of the Federal Data Protection Act (BDSG) is conclusive and applies comprehensively to both the administrative procedure and the administrative process. 34 Contrary to the plaintiff's argument in the oral hearing before the Senate, its position in the BND's data protection oversight does not correspond to that of the Federal Court of Auditors in the audit procedure pursuant to Sections 88 et seq. of the Federal Budget Code (BHO). According to the provision in Section 95 Paragraphs 1 to 3 of the Federal Budget Code (BHO), which is comparable to Section 63 of the Federal Intelligence Service Act (BNDG) in conjunction with Section 28 Paragraph 3 Sentence 2 No. 1 of the Federal Constitutional Court Act (BVerfSchG), the Federal Court of Auditors must be provided with the documents it deems necessary for the performance of its duties upon request within a specified period or submitted to its representatives. The requested information must be provided to the Federal Court of Auditors or its representatives. The obligation to submit and provide information also includes electronically stored data and its automated retrieval. However, Section 95a of the Federal Budget Code (BHO) grants the Federal Court of Auditors the authority to enforce its request based on Section 95 BHO by means of an administrative act (Federal Administrative Court, Judgment of May 12, 2021 - 6 C 12.19 - BVerwGE 172, 306 para. 46). The legislature has expressly not granted the plaintiff such authority vis-à-vis the Federal Intelligence Service (BND). 35 ddd. Finally, the plaintiff's argument that it can derive a legally enforceable position procuratorially by invoking a fundamental right to effective supervisory control—that is, from the fundamental rights of those potentially affected by the CNE measures—cannot be accepted. In its ruling on the anti-terrorism database, the Federal Constitutional Court did indeed decide that in situations where transparency in data processing and individual legal protection can only be guaranteed to a limited extent, ensuring effective supervisory control is of great importance in light of the fundamental right to informational self-determination under Article 2 Paragraph 1 in conjunction with Article 1 Paragraph 1 of the Basic Law and the principle of proportionality. However, in this context, it considered the introduction of dispute resolution mechanisms, such as expanding the right to bring legal action, to be the responsibility of the legislature and not of judicial development of the law (see Federal Constitutional Court, Judgment of April 24, 2013 – 1 BvR 1215/07 – BVerfGE 133, 277, para. 220). However, in this context, it considered the introduction of dispute resolution mechanisms, such as the expansion of standing to sue, to be a task for the legislature and not for judicial development of the law (see Federal Constitutional Court, Judgment of April 24, 2013 – 1 BvR 1215/07 – BVerfGE 133, 277, para. 220). 36 Likewise, it is the legislature's responsibility to grant, in accordance with the case law of the European Court of Human Rights (ECtHR [GC], judgments of 25 May 2021 - No. 58170/13 et al., Big Brother Watch v. United Kingdom - paras. 357 et seq. and - No. 35252/08, Centrum for Rättvista v. Sweden - paras. 356 et seq. and on this: Steiner, GSZ 2024, 32 [37 et seq.]), a right of appeal, if required, for persons potentially affected by CNE measures against a supervisory body deemed suitable by the legislature (cf. Federal Constitutional Court, judgment of 19 May 2020 - 1 BvR 2835/17 - BVerfGE 154, 152 para. 280). Therefore, the plaintiff cannot derive any legal standing she claims from her established position as a complaints body under Section 63 of the Federal Intelligence Service Act (BNDG) in conjunction with Section 28 Paragraph 1 of the Federal Constitutional Court Act (BVerfSchG) when interpreting applicable law. (280). 37 2. The declaratory action brought by the plaintiff as an alternative claim pursuant to Section 43 of the Code of Administrative Court Procedure (VwGO) is inadmissible, just like the claim for performance brought as the main claim, because the plaintiff lacks standing to sue within the meaning of Section 42(2) VwGO, which is also applicable to declaratory actions by analogy (cf., regarding the analogous applicability of Section 42(2) VwGO in this context, for example: Federal Administrative Court (BVerwG), judgments of January 26, 1996 - 8 C 19.94 - BVerwGE 100, 262 <271>, of April 16, 2015 - 4 CN 2.14 - BVerwGE 152, 55 para. 12 and of May 6, 2020 - 8 C 12.19 - BVerwGE 168, 109 para. 1). 12) 38 3. The decision on costs is based on Section 154 Paragraph 1 of the Administrative Court Procedure Act (VwGO).
