German cabinet approves bill on digital violence covering deepfakes, fake accounts and GPS stalking

Germany's federal cabinet approved a draft law on Wednesday, October 7, that is meant to strengthen protection against digital violence, the federal government says. The bill comes from the federal justice ministry led by Stefanie Hubig (SPD) and has two parts: amendments to the criminal code that close what the government calls gaps in criminal liability, and a new digital violence protection act that makes it easier for victims to take civil action against rights violations online. It is still a cabinet draft: according to tagesschau, the Bundestag has yet to decide on it. Hubig first presented a draft in April; netzpolitik.org reports that the cabinet version was tightened in several places since then.

At the centre of the criminal law part is a new offence covering the unauthorised creation and distribution of intimate images, such as sexualised deepfakes or intimate pictures shared to take revenge on someone. According to the government, it makes no difference whether this happens in public or in private, or whether the material is real or computer-generated. Taking voyeuristic nude images in places open to the public, such as saunas or nudist beaches, would also become punishable; netzpolitik.org notes that current law only covers covert nude filming in specially protected spaces, which excludes public saunas, changing rooms and beaches. Covert recordings that target clothed intimate body parts would be covered too when the footage is clearly sexualised, for example by zooming in, with the context, such as a device hidden under a table, taken into account.

The cabinet version goes further than the April draft, netzpolitik.org reports. Possessing and knowingly accessing videos that show a rape would become a criminal offence, punishable by up to three years in prison or a fine. Running fake accounts in another person's name, or spreading deepfakes and similar content that impersonate someone, would be punishable when it can seriously damage that person's reputation. The bill also describes cyberstalking more clearly in criminal law, meaning the repeated and persistent unauthorised monitoring of a person, for example tracking their location with GPS trackers.

On the civil side, people targeted online, for instance with insults, could obtain a court order requiring platforms and internet access providers to disclose details such as the name, date of birth, address and email address of the person behind an account, where these are needed to pursue claims for damages, the government says. According to netzpolitik.org, the request would be filed with a regional court, and the right now also covers messaging services such as WhatsApp, Telegram and Signal where they offer group chats. New in the cabinet version is a court-ordered right to have individual unlawful posts removed, even when the account holder is unknown; this is no longer tied to the separate option of having an account suspended. Courts could still block accounts for a reasonable period after serious violations, especially criminal statements, when more are expected, but the government says the bar is set high to protect freedom of expression.

The bill is also linked to the return of data retention, netzpolitik.org reports. According to the explanatory memorandum quoted by the outlet, platforms and access providers could be ordered to preserve data they already hold on suspected offenders, including IP addresses stored as a precaution. A separate bill from the same ministry would require IP addresses to be kept for an expected three months; mandatory data retention has been suspended in Germany since 2017. A board member of the internet industry association eco called three months of IP storage without cause disproportionate, while Hubig said IP address storage is part of protecting people from digital violence.