The BigBrotherAward in the “Labour and Communications” category goes to Deutsche Telekom AG (German Telecom, plc) for their illegal use of telecommunication connections data to snoop on Telekom supervisory board members and journalists.

Deutsche Telekom have wilfully ignored several legal prohibitions at once, causing critical and possibly lasting damage to public trust in the secrecy of telecommunications, the freedom of the press, and privacy in general.

The list of broken laws makes stern reading. The company has helped itself to internally available data that would otherwise require a judicial order before it can be used for investigative purposes. Several hundreds of thousands of landline and mobile phone records, among them Deutsche Telekom’s own supervisory board members as well as journalists, were illegally processed in an attempt to find out how confidential business information had been leaked to the media.

It has not yet emerged on whose orders this was done, or whether Deutsche Telekom have also unjustly helped themselves to data from other mobile communications providers. There even is a suspicion now that employee representatives’ e-mails were included in the eavesdropping. All this will now be investigated and consequences will be drawn.

But these details are not so very important for the bigger picture. Because this scandal is about a fundamental issue: A company under a legal obligation to respect the secrecy of telecommunications has broken this rule out of pure self-interest. This must deeply worry all citizens in the light of the telecommunications data retention scheme that was voted into law by the German parliament in 2007. From 1 January 2008, Deutsche Telekom are required to store all data about every telecommunications connection for six months and, if certain conditions are met, to hand these data over to the security authorities. Now we must realise that none other than the keepers of these confidential data have ignored and circumvented existing laws for years and on a grand scale — an unparalleled breach of confidence.

The basic right of press freedom has also been violated by Deutsche Telekom: surveillance against journalists, “moles” in media organisations, checks of connection data — there is nothing that the company has shied away from in the last years. What a disaster for critical reporting, this constitutionally guaranteed pillar of our democracy, which depends crucially on a relationship of trust between journalists and informers.

It goes without saying that data protection laws were broken in the Deutsche Telekom eavesdropping scandal. But seeing how shamelessly this was done, it must be asked how worried we should be about the existence of a Telekom subsidiary, SAF Solutions, which is selling data itself, among others the parent company’s data that customers release by blanket-signing the smallprint in their telephone contracts. We have just heard about the theft of 17 million T mobile customer records that took place two years ago, and shortly after that, about a security hole that left 30 million bank details open for access. The chain of negative news is continuing.

What consequences must we draw from such news? And what consequences must we demand for the affected companies? We must be clear about one thing: privacy violations are not a trivial offence. They destroy trust and confidentiality, the basis for unrestrained exchange of thoughts and thus the basis of a democratic society. There is a lot at stake in a company such as Deutsche Telekom, because trust between the business and its customers, but also between employer and employee are the basis of any economic success.

The issues of data protection and privacy must be given higher priority, in companies as well as in society at large. We can no longer allow legislation to lag far behind technological developments and the possibilities of our digital world. Telekom as a huge telecommunications company should be in the forefront of this movement.

Instead they have given an example, through their ruthless infringement of valid laws as well as the rights of their staff, customers, and journalists reporting on their activities, of the ruthless thinking that has spread in the upper ranks of many companies.

This, beyond any doubt, qualifies them for this year’s BigBrotherAward.

Congratulations, Deutsche Telekom AG.

The BigBrotherAward 2008 in the category “Consumers” goes to the Members of the 16th German Bundestag (the Lower House in Germany’s Federal Parliament), represented by Dr. Norbert Lammert, President of the Bundestag, for waving through a number of laws which enforce the collection, long-term storing and sharing of detailed data of travellers.

Travellers nowadays are under constant observation. One could be led to think that travelling per se is sufficient to make one suspicious of terrorist or criminal acts. Not only the permanent video surveillance in train stations and airports, in underground trains and busses leaves a bad aftertaste. Also the German federal state’s laws on mass storing of car number plates — which have been scrapped by the Federal Constitutional Court (Bundesverfassungsgericht, the highest German court), for the time being — must give “respectable” citizens pause for thought. Even travelling on a train can hardly be done without being stored in a database. The German train company Deutsche Bahn received the BigBrotherAward for this last year. Soon there will be no means of travel left that could evade permanent surveillance. And the net is getting ever tighter.

Did you know for instance that in the future the data of of ferry or cruise ship passengers will be automatically forwarded to the marine authorities and the Federal Police, stored there, and even passed on to other authorities and enterprises? Your day trip to the East Frisian Islands will be registered in the future.

This is thanks to a law that was waved through by the Bundestag on 24 January 2008 with only a handful of “nays” and all but unnoticed by the public¹. It goes by a somewhat unwieldy name: Gesetz zur Änderung seeverkehrsrechtlicher, verkehrsrechtlicher und anderer Vorschriften mit Bezug zum Seerecht², approximately “Law on the Amendment of Directives on Seafaring and Traffic and other Directives Pertaining to Marine Legislation”, which in itself might indicate that our representatives didn’t occupy themselves all too much with it. A new section of article 9 of the Federal Maritime Responsibilities Act (Seeaufgabengesetz)³, for instance, has a list of data items that have to be stored for every passenger — for “danger prevention”, of course — among them name, passport number and the ports of departure and arrival. These data may be shared with unspecified “public bodies” — as well as, if necessary, port operators, ship registration offices, port services and other non-public bodies, i.e. private firms. Even data transfers to “foreign or supra- or crossnational bodies” are allowed, with a few vaguely formulated exceptions.

It follows that it is far from clear where your data might eventually land. And the law does not specify how long the data will be stored. There is only a short statement that the ministry for interior affairs and the ministry of transport will deal with this internally. A blank cheque for uncontrolled storage and processing of sea-travel data of 29 million passengers per year.

The reasons for the data collection sound familiar: according to its explanatory memorandum, the law is meant to ferret out alleged “risk persons”. The purpose of collecting passengers’ data used to be above all to find out who was on board at the time of an accident. Nowadays it is about filtering out unwanted people — at the price of another piece of anonymity and privacy of all sea passengers.

So much about seafaring. But the perspective from the air is no better: on 15 November 2007 the members of the Bundestag passed a law⁴ that ratifies the agreement on flight data⁵ between the EU and the USA. The negotiations for this agreement were masterminded during the German Presidency of the EU by, among others, the German Minister for the Interior, Dr. Wolfgang Schäuble — himself a well known data leech. The agreement regulates sharing of data from the airlines with the US Ministry of Homeland Security. It replaces a previous agreement of 2004 which had been scrapped by the European Court of Justice for its lack of legal foundation⁶. A pity, one could almost say in retrospect; for now the level of data protection was lowered even more. For instance, the US now give less guarantees with respect to European norms on data use, and also store them longer: for 15 years.

This is all about the so-called Passenger Name Records (PNR). They are transferred by the airlines to the US authorities even before take-off, and will be processed not only by the customs and the border police but will also be stored at the Ministry of Homeland Security. These PNR data comprise 19 items, among them name, address and credit card data, and also information about hotel reservations, seat number, even individual food preferences come under scrutiny. Even the price of the ticket and the name of the clerk in the travel agency who sold it are stored. For 15 years. Just once ordered the wrong meal on a flight? Been seated beside a suspicious passenger? Booked in the wrong travel agency? Stored for 15 years. A right of access to the data stored about you or towards court appeals is not provided.

Well may you ask: Why are the US authorities so interested in these details? But even more exciting is the question: Why have the members of the Bundestag voted in favour of such a comprehensive sharing of data?

Their own personal data are sacrosanct to many members of the German parliaments. Germans well remember the reactions of some of them when they were called upon to declare their financial interests. But for many members, the privacy of the citizens doesn’t seem to be all that worthy of protection.

By the way: Should you now decide not to travel, or at least not directly, to the US, in order to protect your privacy, this will not help you for long. The EU has similar plans for flights between other non-EU states and Europe. Again, they want to store the sensitive data for years, for whatever purpose. As yet, the Bundestag is opposed to this. We may ask: for how long?

The next data collection laws are imminent, therefore: think twice, dear Members of Parliament, about your decision and do not say “aye” lightly.

For the time being:

Congratulations for receiving the BigBrotherAward, dear members of the 16^th German Bundestag!
Congratulations for receiving the BigBrotherAward, Herr Dr. Lammert!

The BigBrotherAward in the Technology category goes to Canon Germany, Ltd. for embedding an invisible, globally unique device ID in all colour copies, making it possible to find out in retrospect on which device a photocopy was made.

Canon have been using this technology for a few years, and rumours about this function have been circling around the internet for quite a while. Now the BigBrotherAwards jury has seen concrete evidence for the existence of this technology. With an invisible code that is printed on all copies, they can be traced back to the device on which they were made.

On every sheet of paper that runs through a copier, the individual number of the device is printed, using a technology that Canon are keeping secret. The number can not be seen with the naked eye. As a consequence, Canon can find out where a device was made, for example as a service to state authorities, because through service contracts and device registrations the makers know where their photocopiers are located.

If copied identity documents, bank notes or the like are found, the authorities can then pinpoint a copy shop, for example, and put it under observation. For reasons of "investigation tactics", this will surely not be discussed in advance with the owners of the affected shop. There is also no hint about this feature in the user manuals. That is why the BigBrotherAwards jury wants to use the technology award to promote public awareness of this issue.

While such a technology may seem appropriate for detecting crime, it is also a threat to informational freedom. Who will dare to uncover corruption scandals and forward evidence to the media if it is known that a copy is not anonymous, if the employers as owners of the photocopier can trace copies back to an individual department or office? Copy shop workers have confirmed that there have been concrete enquiries from the authorities in the past.

With this technology award, we also want to mark a trend: the handover of human decisions to technology. The copied code is not the only technological trick found in today's copiers, image editing software and colour printers. Pattern recognition is used to prevent the reproduction of protected documents - the printer decides autonomously to stop printing documents, responding with an error message instead. Monetary documents such as bank notes and share certificates are currently affected, but it can be expected that systems used to pursue copyright violations will evolve in a similar way.

Users of such devices can no longer make copies without being monitored and restricted by technological means. Copiers, printers or scanners take care that nothing "forbidden" can be duplicated. And the copies are registered.

What does this mean for example for calls for a political demonstration? Or documents that the originator would prefer not to have copied because they might reveal cases of corruption?

The movements of customers can be traced - which the BigBrotherAwards jury regards as a violation of privacy, and a risk for photocopier owners to become an innocent target of state investigators.

Congratulations, Canon Germany.

Federal Ministry of Finance:
grants Google insights into their web visitors

Alvar Freude

The Finance Ministry scores highly in terms of carelessness with data. It could be described as naïvety, too: On their website, every visit to every page, every search, every order placed for a brochure etc. is being logged. So far, so normal. What is less normal is that the data find their way to Google: The Finance Ministry is using the “Google Analytics” service to collect and evaluate information about its web visitors. Google stores these data in the US. Mr Steinbrück, you are still storing our tax returns in Germany, aren’t you?

Peter Frankenberg, Minister for Science, Research and the Arts, Federal State of Baden-Württemberg:
wants to know exactly who refuses him obedience

Alvar Freude

Peter Frank is obviously a nosy fellow. The Minister for Science, Research and the Arts in Baden-Württemberg instructed all the state’s institutions of higher education to hand over data of all students that were taking the state to court over the introduction of tuition fees. It didn’t earn him the status of “smart fellow” though (for which the region’s people traditionally like to be known): The State Data Commissioner for Baden-Württemberg intervened, and the data had to be erased.

Public health insurance companies:
call for breach of law

Werner Hülsmann

Public health insurance companies regularly send out letters to doctors and hospitals, requesting patients’ files from them although such files may only be conveyed to a common authority called “Health Insurers’ Medical Service” (Medizinischer Dienst der Krankenkassen, MDK), not to the insurance companies themselves. A phrase like, for instance:

“We ask you to fill out the attached report form and send it back to us within 3 days by mail or fax, to be laid before the Medical Service.”

is nothing less than a call for a criminal offence. The unwarranted disclosure of patients’ data by a doctor constitutes a violation of § 203 StGB (the German Criminal Code). If a report is sent to the insurance company by fax, unwarranted disclosure in the sense of the law is literally unavoidable. Only the “Medical Service” is authorised to investigate doctors’ reports on behalf of the insurers. Diagnoses must be withheld from the companies for a reason: The risk would be too great that they might try, e.g. in order to reduce costs, to interfere with the course of treatment and therapy, for instance by delaying payments etc. According to the “Federal Master Treaty for Medical Practitioners” (Bundesmantelvertrag für Ärzte), a report can only be passed on “in a sealed envelope”¹.

Even sealed envelopes marked „Only to be opened by the MDK“ do not, in the experience of MDK employees, guarantee that the envelopes will reach the MDK unopened. In reality, many such envelopes that arrive at the MDK have been “opened inadvertently”.

The only appropriate wording in these request letters from the insurance companies would be: “We ask you to fill out the included report form and send it, through the post, to the MDK in a sealed envelope.” To make sure that the letter arrives at the only place where it may lawfully arrive, the address of the respective MDK branch should be added.

University of Bielefeld, Faculty for Economics:
trusts neither the students nor their doctors

Florian Glatzner

Another note of disapproval goes to the Faculty for Economics of the University of Bielefeld, representing many other departments of many other universities.

In this department (and these other departments or universities) it is no longer sufficient for students to hand in a “normal” writ from their doctors in case they are taken ill before an exam. Instead, the doctors are required to disclose their diagnosis in detail.

This has to be passed on to the exams office, which expressly states that it will then decide itself whether the student is able to take the exam or not.

Final decision on whether a student is medically fit to take an exam is thereby claimed by university bureaucrats and taken away from medical experts. Additionally, universities claim a right to breach a doctor’s obligation to professional secrecy.

“Stadt und Land” (City and Country), a Berlin housing society:
monitor a complete residential area

padeluun

Despite massive protests voiced by some residents, the video surveillance scheme is continuing. It is supposed to get rid of “occurrences that […] are irritating. […] From yob behaviour to dogs in the sandbox to vandalism”. Instead of fostering social engagement in their tenants, they resort to “simply” threatening them at camera point, all the time.

Berliner Verkehrsbetriebe (BVG):
evaluate video surveillance with strict science – or not

Frank Rosengart

Berlin’s public transport company Berliner Verkehrsbetriebe (BVG) have landed a very special coup: Their trials of CCTV monitoring and recording in selected stations were accompanied by a scientific study. Following evaluation, the Berlin Senate was to decide upon continuation of the surveillance. To the surprise of both data protection advocates and Senators, BVG decided even before publication of the evaluation results that CCTV surveillance would be massively extended – without any approval from data protectors or politicians.

Not a winner in 2007: The Federal Minister of the Interior, Wolfgang Schäuble.

Many will wonder why such a dream candidate for the BigBrotherAward is not given this prize in 2007. Some may be disappointed with the jury, thinking that he would have deserved the award like no other – as compulsive incendiary in the “Security & Terrorism” wars, overqualified like only his predecessor in office, Otto Schily (Social Democratic Party) before him.

And indeed, Wolfgang Schäuble (of CDU/CSU, Germany’s conservative parties) has developed an unprecedented skill at scaremongering and a politics of intimidation, spreading fear among citizens – thus displaying a classical trait of terrorism – with the aim of pounding population and parliament into submission, making the public almost long for his controversial plans and give them their blessings. An acting “anti-terrorist”, with his almost daily intellectual attacks he keeps blasting fundamental rights and has long become a threat to democracy, human rights and data protection – the perfect candidate for his own anti-terror database, which was honoured with a BigBrotherAward in 2006.

Even so – first, it would not be a good idea to concentrate on Schäuble alone, to demonise him and thus to narrow down the debate on terrorism. After all, “Schäuble” is simply a metaphor for the disastrous tendency to wage a “war against terrorism” at the expense of civil rights and to change the political system at the expense of a democratic and socially responsible state under the rule of law.

Second, we have the well-founded fear that Schäuble might view a BigBrotherAward as a reason to spur his security extremism even more in an attempt to realize his vision of a preventive-authoritarian police state. That is why we think it irresponsible to give an award until Schäuble, in his role as Minister in charge of protecting the Constitution, stumbles over his own unconstitutional politics at last and is forced to retire. Then, and only then, we might contemplate a BigBrother Lifetime Award, like the one Otto Schily received in 2005 after he had lost his post as Minister of the Interior (due to the governing coalition of the Social Democrats and the Green Party losing the election in September that year).

On the other hand, we owe great thanks to the fact that the Minister of the Interior has greatly promoted an awareness of privacy issues among German citizens, who by now turn out onto the streets in their thousands to demonstrate, who organise demonstrations on the Internet and who have announced plans to file mass appeals with the Federal Constitutional Court (Bundesverfassungsgericht, which rules on the compatibility of laws with the Constitution) to put up a defence against his horror plans. Because of this commendable, albeit involuntary mobilisation of the opposition, he was even offered an honorary membership of the German Society for Data Protection (Deutsche Vereinigung für Datenschutz, DVD).

Dear Minister Schäuble, our heartfelt commiserations for failing to receive an award.

The BigBrotherAward 2007 in the “Consumer Protection” category goes to the international hotel chains in Germany Marriott, Hyatt and Intercontinental (representing many others) for their collection and centralised storing of critical personal information of customers without their knowledge.

“Would like a second pillow? Prefer to take your meals in your room? Want some champagne? Or a second breakfast?”

You believe that hotel staff can read your wishes by taking a deep look into your eyes? – Wrong: They know about all your details, mannerisms and special wishes not from intuition, but mostly from the information stored in the hotel computer system. The real surprise would be if you saw exactly what is stored there.

Among other details, there are your private and professional addresses, telephone numbers, credit card data, date of birth, nationality, passport number, complete bills, use of pay TV, telephone calls. Personnel is urged to note down further details about customers in the system, like family situation, drinking and eating habits, allergies, hobbies, complaints, all kinds of preferences, etc. Once registered in the system, all this information will remain there, even after the customer has left – and, in fact, for times indefinite. This kind of procedure approaches and indeed sometimes crosses the limits of legality¹.

“Non-smoker? Allergic to peanuts? Only rooms on the ground floor?”

But, after all, this information is collected for the good of the customers, to be able to offer them the best service possible!

Or is it? – No, not quite. Valuing every customer and offering him or her the best possible service has always been part of the good tradition of hospitality. But – at least with the big hotel chains – this tradition is a thing of the past. Here, all you get instead of the promise of hospitality is “customer relationship management”², (abb. CRM). Most important item: “Ranking and discrimination”³. Here, it is precisely not the aim to offer all customers the best possible service. Because some customers are worth more than others, and it is the former that need to be targeted. And in order to pick out the lucrative customers from among the riffraff, and be able to make better offers to them, one has to collect as much information as possible⁴.

Nearly every hotel chain nowadays has its own computerised “customer relation” system in which all these data are centrally stored – a veritable bonanza for data miners.

And since all this information is there anyway, other interested parties will easily be found.

If you watch “Attack of the Killer Tomatoes” or perhaps a film titled “Annie Blow His Gun” or other likewise embarrassing items on the hotel-owned pay-TV channel, this will be discreetly shown as “other services” or some such on your actual bill. But the computer system of the hotel will know precisely whether you watched the worst film of all times or a porn movie.

Many hotels are directly connected to online booking systems like “Amadeus” or “Sabre”⁵. There, as well, customers details are being stored. The booking system “Amadeus” advertises a service to travel agencies, for an extra fee, which enables them to import the customer’s complete booking history, including personal details and hobbies, at a click. “Existing and timely customer information from the Amadeus Customer Profiles (air / car / hotel) are always readily available. (...) Besides, the customer information is active for a long time – no matter how long ago the last booking was made.”⁶)

In Germany, you have registration forms that have to be filled in by every customer, but these will at least stay in the hotel to be checked by the authorities only if necessary. In some European countries, France for instance, such details are directly transferred from the hotel to the police. The hotel administration software “Opera”, from the leading software provider “Micros Fidelio” boasts an automated “Police Interface” for these purposes.

But it might not only be the local police who are interested in information about hotel customers, but also foreign secret services.

After all, the guests’ details will not only be stored – as guests assume  – on the computer of the hotel they actually stayed at, but on centralised servers accessible to all the hotels of the chain. And these servers, in turn, at least for the biggest hotel chains are located – guess what – in the USA. So far, data protection hasn’t exactly been all the rage there, anyway. And since 2001 there is also the “USA PATRIOT Act”⁷. Under the pretence of “fighting against terrorism”, this act allows intelligence agencies access to business data, even without a court order.

“No pork? Internet access? Telephone calls to Saudi Arabia from the hotel room?”

What, would you believe, are the conclusions that could be drawn from this?

We can imagine quite a lot of rather unpleasant results for guests. For example: Identity theft is a rather easy game when there is detailed personal information about a customer, readily collected. And once these details hit the yellow press, or come into the hands of competitors, or are being used for blackmail …

Late in 2005, a vast amount of sensitive data the “Marriott” chain had collected got lost from their data-processing centre in Orlando, Florida. Just vanished – that’s what happened to a backup tape with data (including addresses and credit card details) of about 200,000 members of the “Marriott Vacation Club”⁸. The tape is still lost. In the end Marriott had to own up to the loss and notify their customers.

But the real scandal is not this specific case but the normal business of data collection in hotels. Because customers know nothing about these activities.

We got curious and asked an employee of a “Hyatt” what would happen if a customer told the receptionist that he did not wish all this information about him to be stored. The employee had to think a while, then answered that this never happened – because the customers had no idea that all this information was being stored about them, anyway. – “But if he did?!” – “Then we would enter a remark that the customer doesn’t want personal information to be stored …”

To say it in the words of our own Friedrich Schiller:

Hier wendet sich der Gast mit Grausen. „So kann ich hier nicht ferner hausen.“⁹

(roughly: “The guest averts his face with fear: ‘I’d rather not sojourn in here!’”)

Our heartfelt congratulations, dear managers of Marriott, Hyatt, Intercontinental and others!

The BigBrotherAward in the “Politics” category goes to the Federal Minister of Finance, Mr Peer Steinbrück, for introducing a life-long tax identification number for all residents of the Federal Republic of Germany. This Tax ID applies from the time of birth until beyond death. To generate and assign the Tax ID, all registration authorities in Germany share data about all people registered in their area with the recently founded Federal Central Tax Authority (Bundeszentralamt für Steuern).

The Federal Central Tax Authority then transmits the identification number it has assigned to a taxable person back to the registration authority for storage in the local register. In the future, registration authorities have to report every registered birth and every change to data previously transmitted to the Tax Authority.

The Tax ID is justified by the need to facilitate “unique identification of the taxpayer in tax procedures” . But this is the precise effect that a personal code number would have, and this has been ruled to be unconstitutional. As early as 1969, the Federal Constitutional Court (Bundesverfassungsgericht, Germany’s highest court, whose tasks include ruling on the compatibility of individual laws with the constitution) said in its “micro census verdict”: “It would be incompatible with the constitutional value of human dignity if the state were to assume the power of compulsive registration and cataloguing of the individual with their complete personality” .

There has previously been a plan to introduce a unique personal code number for each and every resident of Germany in order to rationalise administrative tasks. At that time – 31 years ago – the Legal Affairs Committee of the Bundestag (the Lower House in Germany’s federal parliament) resolved, with the micro census ruling in mind, that “the development, introduction and use of code systems that would enable a unified numbering of the population within the jurisdiction of such a law is inadmissible” , and the plan was thus abandoned.

In 2003, the Legal Affairs Committee, unfortunately, no longer had any objections against a personal code number, now called the Tax ID. Article 6, paragraph 1 of the German Fiscal Code states:

“For the purpose of initial assignment of the identification number, the registrating authorities transmit to the Federal Central Tax Authority the following data for each person registered in their area of responsibility with sole or main residence:

1. Surname (with titles)
2. Previous names
3. First names
4. Degree
5. Religious name / Pseudonym
6. Date and place of birth
7. Gender
8. Current address of sole or main residence”

The Federal Central Tax Authority stores these data about all residents, supplemented with the Tax ID, the responsible local Tax and Revenue Authority, and the date of death. Even newborn babies are “graced” with a Tax ID. The Finance Ministry explains this with the following reasoning:

“Pursuant to the Income Tax Law, individuals with a domestic place of residence or regular presence are liable to Income Tax from the time of their birth. While these taxable persons will normally owe no Income Tax, situations in which they do can occur (e.g. with children gaining capital income from inherited assets). Without the Tax ID, such cases would be difficult to determine, as the tax authorities would have no information on the liable person due to a lack of tax registration.”

The Tax ID stays with a person throughout their life, whether they marry, change their name, move house, undergo a sex change, or die: your Tax ID won’t leave you! It even sticks with you for 20 years after your death.

The Fiscal Code does restrict the use of the Tax ID to the purposes defined within that code. However, for one, the list of purposes contains the get-out clause “to enable the revenue authorities to fulfil their duties assigned by legal provision” . So as soon as the duties are extended, the Tax ID is given new powers. That is unacceptable, the definition must be made more precise! Also, experience shows that over time it will not suffice to prevent further uses just through the law, because laws will over time be changed to meet new demands coming from the administration or the economy. In addition, only those “non-public institutions [emphasis by the BBA jury] act unlawfully who collect or use the Tax ID deliberately or carelessly for other than the permitted purposes, or who sort their data or make them accessible by the Tax ID for other than the permitted purposes.”  Therefore, abusive uses of the Tax ID by public institutions will not be penalised!

Thus the noose around the citizen’s neck is tightening ever more, as next to identification through biometrics or cameras, financial transactions can now be directly related to the individual. These technical means of combining data will surely kindle new desires, which will sooner or later lead to the list of permitted purposes for which the Tax ID can be used getting longer and longer.

Our congratulations for the BigBrotherAward, Federal Minister of Finance, Mr Peer Steinbrück!

The BigBrotherAward 2007 in the “Workplace“ category goes to Novartis Pharma GmbH represented by their CEO, Dr Peter Maag, for spying upon their employees and the resulting breach of personality rights.

What does one expect from a company that has voluntarily committed itself to fair action on various occasions? For instance, through the code of conduct of an association called “Voluntary Self-control For The Pharmaceutical Industry” (Freiwillige Selbstkontrolle für die Arzneimittelindustrie)? From a company that has joined the “FairCompany Initiative” to demonstrate its fairness as an employer? A company that professes publicly to be willing to promote a positive work/life balance and boasts high ranks in more or less independent employers’ ratings? That promises respect for human rights and fair working conditions in its “Corporate Citizenship Guidelines”?

By no means would one expect that it has a standard procedure of sending detectives after its sales representatives to meticulously take minutes of their visits to GPs and pharmacies. Neither does one expect that results from a survey at the work place, which was expressly declared confidential, are returned to the employees with an appraisal from the human resources department. Just as one does not expect that the agency entrusted with carrying out this survey reacts to complaints from the employees by saying: “You can’t have been that naïve!” (i.e. to think that the employer would really not get to see the results.)

Those who did think that self-regulation actually works are in for a big disappointment.

Quite obviously the company has difficulties to implement its self-imposed claims to fairness when employees don’t function to perfection.

Especially when it comes to the sales force, the reality seems to be closer to the state of war that was evoked a few years ago, namely when the CEO of the pharmaceutical branch of Novartis AG tried to motivate his sales representatives with slogans like “Kill To Win – No Prisoners”. It was then at the latest that the company showed how it regards the ideal world of its glossy brochures with their propagated respectful attitudes: not really suited for everyday use. Even if the wording had to be toned down after protests, martial vocabulary still dominates internal communications, as one can see from conference papers of the German branch of Novartis Pharma GmbH. “The best product, the best weapons.” “Street fighting.” “To redline and attack the competition without compromise.”

How does one go about “lustily sweeping in” respectfully?

Not every sales representative seems to be able to manage that balancing act. And not every one is able to reach the required, unrealistically high “average” of daily visits to doctors and pharmacies by legal means. It appears unavoidable that this pressure leads to little and not-so-little fibs when one doesn’t want to face severe losses of income.

A high need of surveillance is all too easily justified by this self-inflicted situation, and thus the company goes to war not just against their competitors but against their own employees, too. And they are not exactly squeamish in their choice of weapons. Along with the inofficial encouragement of employees to squeal on their colleagues, sleuths are being sent after sales staff to meticulously write down the details of each visit. “Seek, and ye shall find”, and each find makes it easier for the company to get rid of an unwanted employee. Such continuous surveillance in violation of personality rights seems to be standard behaviour – even the works council feels a need to warn about this in one of its publications. And we might ask ourselves whether the works council shouldn’t protect the employees against such measures, rather than just inform about them.

Apparently, there is some method in this carefree approach to personality rights of the employees, despite all the standards set by self-commitments. This must be the only explanation why the results of a supposedly confidential online survey, termed “self-assessment”, were returned to employees a short time later: personalised, rated and with suggestions for improvement from the staff department.

It is hardly surprising, then, to hear about obstructions of visits to staff meetings, illegal publications of so-called “racing lists” as well as sick leave lists, and about the mail to the works council being habitually opened of in the post room.

Novartis Pharma GmbH still have a lot of fighting to do on the data protection front, Dr Maag. Congratulations for receiving the Big Brother Award!

The BigBrotherAward in the “Regional” category goes to the Municipal Authority for Education and Sports of the City of Hamburg represented by Ms Alexandra Dinges-Dierig, Senator for Education and Sports, for introducing a central register for all pupils and students with the (further) purpose of finding foreign families without a residence permit.

Hamburg is known nationally for its harsh and rigid approach towards deportations. At one time, a Palestinian from Nablus in the West Bank who has been living in Germany for 21 years is being deported, at another, underage students are about to be deported – without their parents, who have a residence permit.

Considering this, it is hardly surprising that all possible means are being used to snoop out families for the next deportation. Therefore, the Aliens Registration Office makes use of the Central Register of Pupils (Schülerzentralregister) to find children and their parents without a current residence permit. In Germany, attending school is compulsory. Not only that: Access to education is a civil right¹ and “no person shall be denied” this right², as has been stated by the European Convention for Human Rights, the Covenant on Economic, Social and Cultural Rights³ and the UN Convention on the Rights of the Child⁴ .

Access to education is a right of every single child, no matter what their nationality. And regardless of whether their residence in the country in question is legal or not.

In 2006, the amendment of the Law on Schools in Hamburg (Hamburgisches Schulgesetz) and the by-law on Data Protection in Schools (Schul-Datenschutzverordnung)⁵ also introduced the Central Register of Pupils. All schools of the city state are obliged to hand over the details of all their pupils, which are then automatically compared with the Register of Residents. This system was introduced to find children who are not attending school, which might point to a case of neglect. It is the declared aim of this data collection to prevent tragic cases like that of Jessica, the seven-year-old girl that died of hunger in her parents’ flat in 2005 after years of neglect.

However, the Register of Pupils would hardly have helped Jessica: The Education Authority knew about her and had even instituted proceedings for a civil penalty against the parents because their daughter remained absent from school. However, nobody asked why the girl failed to attend. The Education Authority then obviously considered their job done – neither the welfare authorities nor the police were approached. If the authorities do not follow up on such a case, even the largest collection of data will be of little use.

For what, then, is the Central Register of Pupils actually of use? Except to perhaps secure some software developers’ jobs?

Another girl also had problems with the authorities in Hamburg, but not because they would not take an interest in her: An anonymous informer had alerted the authorities that thirteen-year-old Yesim and her mother lived in Hamburg without permits, in the flat of the grandmother. For the authorities, this was a typical case of “joining family illegally”, and the girl and her mother, who had both lived in Hamburg for thirteen years, were threatened with deportation. If Yesim had not been the model of a integrated, popular and successful pupil that she is, she and her mother would certainly have been deported long ago.

But now, the authorities no longer have to depend on grassing neighbours: The Register enables them not only to find registered pupils who do not go to school. No, quite the contrary: It is also possible to find pupils who do go to school but are not registered (that is, pupils and students who live in Hamburg without a residence permit), as the data of the Register of Pupils and the Register of Residents are continuously and automatically compared.

Now, is the Central Register of Pupils more of a Yesim file than a Jessica file, as some refugee organisations suspect? Indeed, finding children without a residence permit is one of the aims of the Register of Pupils, as particularly the conservative party CDU in Hamburg has demanded. It only makes sense, then, that the Aliens Registration Office has access to the information.

Article 9 of Hamburg’s Ordinance on Data Protection in Schools states:

§ 9 Transfer of information to other public authorities

“The responsible authority may pass on personal details from the Central Register of Pupils (as listed in §7) to other public authorities, if this is necessary for the duties of either the granting or the receiving authorities. The receiving authorities may use the information only for the purpose for which they were passed on. [...]”

Note this: “The receiving authorities may use the information only for the purpose for which they were passed on.”

Ms Dinges-Dierig, can we take that to mean that if the details were passed on for deporting of families without residence permit, then they may indeed only be used for deportations?

The authorities claim that so far, information from the Register has not played a part in any deportations. No children without current residence permit have been found. This is hardly surprising: Their parents are afraid that sending their kids to school would almost automatically lead to deportation of the whole family – and that fear is well-founded. It is quite understandable that under such circumstances, families decide against letting their children attend school. It is a fear that families have had in the past as well, but in most cases, NGOs like “Fluchtpunkt” [“Point of Rescue”]⁶ succeeded in convincing parents that they were safe in sending their children to school. With the Register, that is no longer possible – the families in question have taken their children out of school. It is hardly surprising, then, that no “illegals” could be found. A law that was supposed to serve the welfare of children has had the opposite effect.

Yes, the Central Register of Pupils is meant to benefit children, though it is not at all able to do so. It would not have protected Jessica against her abusive parents and neglectful authorities. The “welfare of children” appears to have quite a range of definitions – if we follow the CDU party and School Senator Dinges-Dierig in the Senate of Hamburg, we arrive at the following position: As living without a residence permit is per se detrimental to the welfare of children, they could only benefit from ending that illegality⁷. Whether the kids will be living a better life in Afghanistan, the Gaza Strip or Iraq is more than questionable. Still: Looking at the work of the Aliens Registration Office in Hamburg, removing unwanted persons into unstable regions is not an unlikely option, as quite a number of cases have shown.

This rather strange understanding of child welfare does not work in real life, anyway: Parents are taking their kids out of school rather than risking detection and deportation. Thus, Hamburg actively counteracts the right of access to education – a right that also includes, let us not forget, children without a residence permit.

It is true, schools have been under an obligation to alert the authorities to children without the proper documents even before this. But whoever is signed in for school now gets registered centrally, and the details are automatically being compared with the Register of Residence. The schools are under considerable pressure to register the children. They might, of course, remain silent about those without papers, but those pupils would then just not exist for receiving certificates and final exams and would not be insured against accidents at school.

So, what have we learned, Ms. Dinges-Dierig?

1. Your penchant for collecting personal data aggravates the humanitarian problem of refugees and families without valid residence permit rather than reducing it. The children in question are in fact being denied their right to access education.
2. The professed aim, putting compulsory attendance into effect, could be achieved much more cheaply by other methods – for example, if your department actually tried to find why children fail to attend school.
3. If data are collected and centrally stored, they can be misused for a wide range of purposes.

Congratulations for the BigBrotherAward, Ms Dinges-Dierig.