The right to informational self-determination protects every individual's authority, in principle, to decide for themselves how their personal data is disclosed and used. It forms part of the general right of personality and is derived from Article 2(1) in conjunction with Article 1(1) of the German Basic Law (Grundgesetz – GG). The Federal Constitutional Court expressly recognised this fundamental right in its Census Act judgment of 15 December 1983. It forms a key constitutional foundation for data protection in Germany.
What does informational self-determination mean?
Informational self-determination refers to the fundamental right of every individual, in principle, to decide for themselves whether and how their personal information is disclosed and used.
It protects an individual's freedom to determine how their own data is disclosed and used and to be protected against the unlimited collection, storage, use and disclosure of personal information.
This fundamental right does not only cover particularly sensitive information, such as health data or details about an individual's personal circumstances. Everyday information, such as a person's name, address or contact details, also falls within its scope of protection.
The context in which personal information is collected and used is decisive. Combining different data sets may, in certain circumstances, reveal extensive insights into an individual's behaviour and personal circumstances.
However, informational self-determination does not guarantee unrestricted control over all personal data. Interferences justified by law are permissible under certain conditions.
How did the right to informational self-determination arise?
The Federal Constitutional Court developed the right to informational self-determination in its so-called Census Act judgment of 15 December 1983 (BVerfGE 65, 1).
The starting point was the 1983 Census Act, which provided for the collection of extensive personal information about the population. Constitutional complaints were lodged against individual provisions of the legislation.
The Federal Constitutional Court found that the increasing use of automated data processing creates new risks to personal freedom. In particular, the unlimited collection and linking of personal information threatens individuals' ability to shape their lives autonomously.
The Court therefore derived the right to informational self-determination from the general right of personality under Article 2(1) in conjunction with Article 1(1) GG.
In its judgment, the Court established fundamental requirements for the processing of data by public authorities.
These include, in particular:
- Legal basis: State interference with this fundamental right requires a constitutionally compliant legal basis.
- Clarity and certainty of legislation: The conditions and scope of any interference must be recognisable to the individuals affected.
- Proportionality: Interference must not go beyond what is necessary and appropriate to achieve a legitimate aim.
- Safeguards: Appropriate organisational and procedural measures must be in place to prevent violations of personality rights.
The Census Act judgment is regarded as a landmark decision in the development of modern data protection law in Germany.
What significance does informational self-determination have for data protection?
The right to informational self-determination forms an important constitutional foundation for the protection of personal data.
As a fundamental right, it applies directly to state interference. At the same time, it influences the development and application of data protection legislation, which also applies to private companies.
At European level, Articles 7 and 8 of the Charter of Fundamental Rights of the European Union (CFR) guarantee the protection of private life and personal data. The General Data Protection Regulation (GDPR) gives concrete effect to data protection through directly applicable provisions.
Key data protection principles are closely linked to the concept of informational self-determination:
- Lawfulness and transparency: Personal data may only be processed on an appropriate legal basis and in compliance with transparency requirements.
- Purpose limitation: Data must be collected for specified, explicit and legitimate purposes.
- Data minimisation: Processing must be limited to the personal data necessary for the relevant purpose.
- Data subject rights: Rights such as access, rectification and erasure strengthen data subjects' rights in relation to controllers.
The GDPR therefore contains key safeguards that reflect the principles underlying informational self-determination. However, the fundamental right itself and the individual rights available under the GDPR must be distinguished as a matter of law.
Under what conditions may the right to informational self-determination be restricted?
The right to informational self-determination is not absolute. According to the case law of the Federal Constitutional Court, interference may be permissible in the overriding public interest, provided certain constitutional requirements are met.
As a rule, state interference requires a constitutionally compliant legal basis. This must be sufficiently precise and comply with the principle of proportionality.
The proportionality assessment includes, in particular, the following requirements:
- Legitimate aim: The interference must serve an objective permitted under constitutional law.
- Suitability: The measure must be capable of contributing to the achievement of that objective.
- Necessity: No equally effective, less intrusive measure may be available.
- Proportionality in the strict sense: The severity of the interference must not be disproportionate to the objective pursued.
Statutory restrictions must also incorporate appropriate safeguards. As a general rule, the more serious the interference with personal freedom, the higher the requirements for justifying it.
Private companies are likewise not permitted to process personal data arbitrarily. The specific conditions governing the lawfulness of their processing arise in particular from the GDPR and other applicable data protection legislation.
Consent is not required in every case. Processing may also be based on other legal grounds, provided that the relevant requirements are met.
What significance does informational self-determination have in everyday digital life?
Increasing digitalisation makes informational self-determination even more important. Websites, digital services, mobile applications and connected devices process large volumes of personal data.
The linking of different types of information is particularly relevant. Individual pieces of information that initially reveal little about a person may, when combined, provide detailed insights into their personal interests, habits or behaviour.
This is particularly relevant in the following areas:
- Online services: Processing usage data and creating personal usage profiles.
- Mobile applications: Collecting location data, device information and other personal details.
- Digital communication: Processing communication and contact data.
- Connected devices: Collecting information about the use of technical systems in everyday private life.
Informational self-determination protects individuals against the unlimited collection and use of such information. The specific data protection requirements arise from the statutory provisions applicable in each case.
For companies, this means in particular that personal data may only be processed in compliance with the applicable legal requirements and that the associated risks to the rights and freedoms of data subjects must be taken into account.
Practical example: Creating usage profiles through an online service
A company operates a digital platform and records the usage behaviour of its registered customers. This includes, among other things, the content they access, their search queries and their interactions with the platform.
The company subsequently combines this information to create individual interest profiles and display personalised content.
Linking the data makes it possible to draw detailed conclusions about users' behaviour and personal interests. As a result, the processing engages the principles underlying the protection of informational self-determination.
The company must therefore comply with the relevant data protection legislation. In particular, it needs an appropriate legal basis, must inform users about the processing and must meet the statutory requirements concerning purpose limitation and data minimisation. Depending on the technology used and the nature of the processing, further requirements may also apply.
legal data assessment: Informational self-determination highlights the fundamental-rights significance of protecting personal data. Companies should pay particular attention to the impact on data subjects' personality rights when combining and analysing different data sets. Clearly defined processing purposes, a valid legal basis and appropriate safeguards are essential. Lawful data processing does not always require consent, but it must comply with the applicable statutory limits.
Legal bases
Articles 1(1) and 2(1) GG; Articles 7 and 8 CFR; Articles 5 and 6 GDPR; Articles 12 to 22 GDPR; Federal Constitutional Court, judgment of 15 December 1983 – 1 BvR 209/83 et al., BVerfGE 65, 1 (Census Act judgment).
Frequently asked questions about informational self-determination
Is informational self-determination a fundamental right?
Yes. The right to informational self-determination is a fundamental right recognised by the Federal Constitutional Court. It is derived from the general right of personality under Article 2(1) in conjunction with Article 1(1) GG.
What did the 1983 Census Act judgment establish?
The Federal Constitutional Court held that the protection of personal freedom also includes the authority, in principle, to decide for oneself how personal data is disclosed and used. It also established constitutional requirements governing state interference with this right.
Does the right to informational self-determination also apply in relation to companies?
The fundamental right directly binds public authorities. In relation to private companies, the protection of personal data is ensured in particular by the GDPR and other applicable provisions. The underlying constitutional principles also influence the interpretation and application of data protection law.
May the state collect personal data without consent?
Yes. The state may collect data without consent if there is a sufficient legal basis and the other constitutional and data protection requirements are met.
What is the difference between informational self-determination and data protection?
Informational self-determination refers to the constitutionally protected right to decide, in principle, how personal data is disclosed and used. Data protection encompasses the legal and organisational rules governing the protection of personal data and the safeguarding of data subjects' rights.
Related terms.
Data protection Data protection refers to the protection of natural persons with regard to the processing of their personal data. Under Article 1(2) of the General Data Protection Regulation (GDPR), the Regulation protects the fundamental rights and freedoms of natural persons, in particular their right to the protection of personal data. The right to informational self-determination, derived from Article 2(1) in conjunction with Article 1(1) of the German Basic Law (Grundgesetz – GG), also provides an important constitutional foundation. Data protection is intended to ensure that personal information is processed only in accordance with the requirements laid down by law. Prohibition subject to permission (Verbot mit Erlaubnisvorbehalt) The prohibition subject to permission describes the principle that processing personal data is prohibited unless it is permitted by a legal basis. Art. 6(1) GDPR 