Germany: Federal Court of Justice permits forcible use of fingerprint to unlock smartphone

The problem of unlocking crucial evidence

"There is now no area of crime where smartphones do not play a role," says Markus Hartmann, Senior Public Prosecutor and head of the Central Office for Cybercrime in Nordrhein-Westfalen, Germany. However, when seizing a smartphone, investigating authorities often face difficulties unlocking it. Depending on the model, decryption by experts can be time-consuming or even impossible – particularly since suspects are not obliged to cooperate with the authorities.

Confronted with this problem in recent proceedings in Germany, the police ordered and carried out the unlocking of two smartphones found on the suspect's premises during a judicially approved raid by forcibly using the suspect's fingerprint. The courts and the BGH were called upon to determine whether this conduct was lawful and whether the evidence obtained could be used. The BGH upheld the lawfulness of the conduct – under specific circumstances. 

The accused's body as a "natural key"

Central to the issue is whether guiding a suspect's finger to unlock a mobile phone violates their right against self-incrimination (the so-called nemo tenetur principle). According to the BGH, it does not.

The BGH stated that this right only protects the suspect against active participation in their own conviction but not against merely tolerating investigative measures. Even if applied forcefully, using the accused's fingerprint to unlock a mobile device merely involves treating the body as a "natural key" to overcome a technical security measure. Such conduct has long been permitted under the Code of Criminal Procedure in comparable cases, such as identifying individuals based on the papillary lines of their fingers. 

Indeed, the BGH relied on Section 81b of the Code of Criminal Procedure, which in essence allows for fingerprints to be used to identify the accused. But this provision goes further. It states that, insofar as necessary for the purposes of criminal proceedings, photographs and fingerprints of the accused may be taken against their will, and similar measures may be carried out on them. For the BGH, unlocking a mobile device using a fingerprint qualifies as "similar measures necessary for the purposes of criminal proceedings". Therefore, the conduct of the investigative authorities has a legal basis in Section 81b of the Code of Criminal Procedure.

Judicial approval and proportionality

The BGH set out two requirements for the lawful use of the accused's fingerprint to unlock a mobile device:

• The police must carry out a search to obtain the smartphone and the data stored on it, and such search must be approved by a judge. Unlike Austria since 1 January 2025 (see our previous Legal Insight https://www.schoenherr.eu/content/seizure-and-examination-of-mobile-data-in-austria-new-legal-framework-finally-passed-in-parliament), Germany does not yet have a specific legal framework for the seizure of data. However, mobile devices are regularly seized during searches anyway and such searches are subject to judicial approval, as was the case in the present case.
• The forced unlocking must be proportionate. In this regard, inter alia, the BGH especially considered that there was clear evidence suggesting that the suspect had deliberately used the mobile devices to commit a criminal offence. In such cases, suspects must accept that law enforcement authorities will access the data stored on the devices.

EU law not violated

Fundamentally, forcible unlocking is compatible with Directive 2016/680/EU and case law of the European Court of Justice. The Directive serves to protect natural persons in relation to the processing of personal data in the context of criminal proceedings. However, according to the BGH, it does not generally preclude using a fingerprint without consent to unlock a mobile phone. This is because such a measure is permissible in the context of criminal investigations, provided it has a clear legal basis, serves a legitimate purpose and is proportionate. As elaborated upon above, the BGH deemed these requirements to be fulfilled.

No easy solutions

The decision has sparked considerable debate. While it directly concerns Germany, it will be interesting to see whether other jurisdictions take up the BGH's reasoning on the nemo tenetur principle and Directive 2016/680/EU. Similarly, time will tell whether the BGH's reasoning will also be applied to other security measures found on mobile devices, such as Face ID. Using data continues to pose complicated legal questions with no easy solutions. However, given the importance of the data on mobile devices, this should come as no surprise.

author: Oliver M. Loksa