A German federal court said on Friday that several laws giving investigators access to personal internet or phone data were unconstitutional and needed to be amended to better protect privacy.
The court ruling is a victory for privacy activists who had said there were not sufficient limits on when and why federal police or domestic intelligence can access the names and addresses or even e-mail passwords and mobile phone PINs of users.
One of the suits on which the ruling published on Friday is based was filed by Katharina Nocun and Patrick Breyer of the Pirate Party, along with around 6,000 joint plaintiffs, in 2013.
They had said that Germany's telecommunications law gave investigators sweeping access to users' private data, risking the creation of "a new secret police of the internet that can ransack and scan our most intimate thoughts".
The court said on Friday that investigators can in principle be given access to the data of users, but that laws needed to balance how urgently such data was needed - to fend off imminent danger or solve crimes - with the protection of legal rights.
Otherwise they encroach on users' right to determine the use of their data as well as on telecommunications privacy.
Neither the existing laws regulating under which circumstances telecoms companies such as Deutsche Telekom can hand over the data, nor the ones determining why investigators can request such data, are in line with Germany's constitution, the court said.
Legislators will now have time until the end of 2021 to amend the laws, the court said.