Subject: Re: [sacm] Legal aspects of System monitoring

From: [email-masked] (Martin Rex)
Date: Tue, 11 Dec 2012 01:50:18 +0100 (CET)

Tony Rutkowski wrote:
>
> On 8/6/2012 1:21 PM, Martin Rex wrote:
> >
> > You have to realize that the problem here is not a security policy
> > by itself.  But trying to enforce compliance by constant electronic
> > surveillance of end user systems will probably be illegal in most cases
> > in Germany.
>
> Maybe this is getting off-topic, but could
> you provide some citations to "German law."
> These assertions seem like rather extreme
> interpretations of something.  It certainly does
> not comport with the understanding of the
> law that my German government colleagues
> have.

Maybe your German government colleagues should pay more attention
to decisions of the Federal Administrative Court of Germany.

There was a decision of the Federal Administrative Court of Germany 
last year that should provide a clue just how deep into illegal
territory the monitoring of employee computing equipment is
for an employer.

Decision: BVerwG 2 A 11.08 vom 31.03.2011

Main Web Site:
http://www.bundesverwaltungsgericht.de/weitere_Informationen/Information_and_Decisions__EN__g0.html

Online Access to decisions for non-commercial use (in German language only)
search for "BVerwG 2 A 11.08"
http://www.bundesverwaltungsgericht.de/Entscheidungen/Entscheidungssuche_ny.html

The relevant parts of that decision are paragraphs 17-19, basically
re-iterating the Federal Constitutional Courts requirement for a
existence of a formal statute law by the parlamentarian legislator
to access non-public personal information.  That the information
was stored on the network storage of the employer, and that the use
of that storage was officially strictly limited to business-related
issues was found to be irrelevant!!

This particular case was about an employee working for the German
federal/governmental agency "Bundesnachrichtendienst (BND)"
(which might be vaguely liked to the CIA among US government agencies).
The employer (BND) had provided non-public network storage to the
employee, and searched, probably among other locations, the contents
of that network storage for indications of non-compliant publication
of confidential information.

Since there was no probably cause and no official criminal investigation
when the search was performed, there was no applicable formal statue law
authorizing this search, so the search was found to be a severe violation
of the employees right of informational self-determination, based
on the requirements established by the Federal Constitutional Court.

After this decison, the employee sued his employer for "punitive damages"
from this illegal search of his personal data.  The employee was recently
awarded EUR 3000,- by "Landgericht Berlin"

http://www.berliner-zeitung.de/politik/bundesnachrichtendienst-bnd-muss-zahlen,10808018,21051542.html

That latter decision about the awarded damages is still fresh, and
could potentially be appealed by the employer.  That decision also
hasn't been published yet, but given that it is based on the very
clear determination "BVerfG 2 A 11.08", it will be easy to justify
such a payment of damages.  It sides quite well with decisions
of the Federal Labour court for severe violations of employee
personality rights.

-Martin