When an Afghan woman* came to Germany and applied for asylum in 2019 without a valid passport, one of the first things officers at Germany's Federal Office for Migration and Refugees (BAMF) did was comb through her phone to obtain information which they later used in her asylum application procedure.

On Thursday, the Federal Administrative Court in Leipzig ruled that this was unlawful because the officers had not exhausted less intrusive means to confirm the refugee's identity first. 

"The court made a decision over one individual case, but what happened to our client is common practice in Germany," Lea Beckmann, one of the plaintiff's attorneys and a member of the legal team at the nonprofit Society for Civil Rights (GFF) told DW after the verdict was announced. "It's been clearly established now that this current practice at the BAMF is illegal — which means that the BAMF must stop it."

Supported by the GFF, the Afghan asylum-seeker had sued Germany's Federal Office for Migration and Refugees (BAMF) in 2020.  In June 2021, a regional court in Berlin ruled in her favor. But the BAMF challenged the decision and asked the country's top judges in Leipzig to take a second look. 

On Thursday, the judges in Leipzig threw their weight behind the first ruling. They said that before searching the plaintiff's phone, the BAMF should have checked other documents she had submitted as proof of her nationality, such as her marriage certificate or an Afghan identity document which was lacking biometric data. 

The case in Germany — a country known as a world forerunner on data protection — has been watched closely by migration authorities around the world, which use similar methods in asylum applications. In March 2022, a UK court ruled that British authorities had broken the law when they seized and downloaded data from asylum-seekers' phones.

The ruling will also have major consequences in Germany. "After this decision, it's clear that the BAMF — unlike current practice — must first check other documents and listen to people before it can request access to their cell phone data," said Matthias Lehnert, the plaintiff's second lawyer. "And since there are numerous other means to prove a nationality, I assume the entire practice will become obsolete."

The BAMF declined to comment on the ruling, citing its practice of not reacting before a court's written opinion has been published. This is expected in the coming weeks. Ahead of the trial, a spokesperson for the office had defended the phone searches in a statement to DW as "fundamentally important for the security of our country and for the accuracy of asylum decisions." 

How phone searches work

A paragraph Germany added to its asylum law in 2017 allows authorities to demand access to the cell phones, laptops, and tablets of asylum-seekers if they cannot provide a valid passport or ID card and if an identification "cannot be achieved by milder means."

Once inside the devices, authorities use software to scan files for clues about where the phones have been. Such digital evidence includes location metadata attached to photos, country codes of numbers saved on the phone, or the language used in text messages.

The program automatically compiles results in a report. That document is kept confidential until a lawyer at the BAMF grants the case workers access. They can then factor in the results when they decide whether to grant asylum.

Since introducing the practice in 2017, the office has searched over 80,000 devices of asylum-seekers, a representative for the BAMF said during Thursday's trial. 

Backlash from Germany's civil society

Since the practice was first introduced, it has been met with harsh criticism from civil liberties advocates in Germany — where the experience of two authoritarian regimes has made people particularly sensitive about privacy, and where the world's first data protection law was passed in 1970.

At the forefront of that fight is the Berlin-based nonprofit GFF. In 2019, the group published an investigation arguing that phone searches are both ineffective and intrusive.

By 2020, the group had convinced three asylum-seekers from Syria, Afghanistan, and Cameroon to sue the BAMF. In three separate lawsuits, they argued that the agency had demanded access to highly intimate data stored on their phones without meeting the legal requirements.That, they said, encroached on their fundamental right to privacy.

The BAMF has not changed its practice in the 20 months, but the Leipzig ruling will ramp up the pressure.

What about Germany's data protection watchdog?

The ruling will also have an impact on a separate complaint filed by the GFF that could put an end to the phone searches. 

In early 2021, the nonprofit asked Germany's data protection watchdog, the Federal Commissioner for Data Protection and Freedom of Information, to look into the phone searches. Unlike the courts, the office has the power to directly order the BAMF to abandon the practice.

Two years later, the watchdog has not yet reacted on the issue — something attorney Lea Beckmann of the Society for Civil Rights described as "disappointing."

Following Thursday's verdict, Beckmann said that she expected the watchdog would "wait for the court's written opinion with the exact reasons for its decision." 

"But after that, there is no reason for it to wait any longer," she pointed out. 

*The woman's name is being kept secret at her lawyers' request for fear of repercussions.

Edited by: Rina Goldenberg

This article was updated on February 16 to include the court’s decision. 

While you're here: Every Tuesday, DW editors round up what is happening in German politics and society. You can sign up here for the weekly email newsletter Berlin Briefing.