Life profiling as a new category of constitutional interference in light of the Orders of the German Federal Constitutional Court of 24 June 2025, 1 BvR 2466/19 (Trojan I) and 1 BvR 180/23 (Trojan II)

The Orders of the Federal Constitutional Court in the ‘Trojan’ cases concern the permissibility of preventive telecommunications surveillance and so-called source telecommunications surveillance, carried out through intrusion by technical means into the IT system of the person subject to the measure. The significance of these rulings extends beyond communications monitoring and the use of spyware. The Court develops the concept of constitutional protection of the confidentiality and integrity of information technology systems, indicating that protection extends to systems containing – either on their own or through network connections – data of such quantity, diversity and quality that access to them makes it possible to gain insight into significant aspects of a person’s life or even to create a comprehensive personality profile. These rulings, read together with the earlier line of case-law concerning the right to informational self-determination and automated data analysis, make it possible to reconstruct the constitutional standard of protection against life profiling. The Court does not introduce an autonomous, explicitly named ‘right not to be profiled’, but it establishes protection against the State acquiring the ability to transform the disparate digital traces of the individual into a holistic, dynamic and operationally useful model of that individual's life, relationships, behaviour, vulnerabilities and likely future action.