This is the draft in question: https://drive.google.com/file/d/1gV4FIr6cNu2s1W37vd7NJZC4HNceruKL/view https://drive.google.com/file/d/1gV4FIr6cNu2s1W37vd7NJZC4H

This is the draft in question: https://drive.google.com/file/d/1gV4FIr6cNu2s1W37vd7NJZC4HNceruKL/view https://drive.google.com/file/d/1gV4FIr6cNu2s1W37vd7NJZC4HNc... Translated to English: https://www.scribd.com/document/439773952/BMJV-GE-Bekampfung-Rechtsextremismus-Hasskriminalitat-EN https://www.scribd.com/document/439773952/BMJV-GE-Bekampfung... One of the notable proposed changes is that providers are required to notify federal law enforcement about content that they removed from their platform and which the provider determined to likely violate German laws, including the content and the user's IP address and [source] port number. The intention is to prosecute these cases. There is a provision that requires the user to be notified about this, except if law enforcement specifically requests not to notify the user. The changes to §15a are very broad and allows a variety of government institutions to request not just customer contract data ("Bestandsdaten", which would be regulated by §14), but also "Nutzungsdaten", i.e. user IDs, IP addresses, logs or similar usage data, even for misdemeanor-level offences. It's a bit of a hyperbole, but to my understanding, this would, in theory, include parking violations and littering, which feels wrong. Requesting such data was, to my understanding, regulated only superfically by the TMG in §15 (5) with unclear scope. Previous court cases established that this would include IP address data (LG Frankfurt/Main, 2-03 O 174/18). The new paragraph expands on this by explicitly allowing requests to be made using just an IP address (rather than a user identifier), by clarifying the scope to include all usage data, and requiring security measures to be taken to ensure that the data is transmitted securely. The draft document only mentions about passwords in the comments (page 29), not the actual proposed changes to the law, which only mentions "data which can be used to access storage media on a device". This is an oddly specific provision that likely targets full disk encryption schemes that have a server-side key backup (i.e. Windows Bitlocker). This was copy-pasted from the existing §113 TKG, which regulates ISPs, and calling these "passwords" is a very unfortunate choice of words by the authors of this draft document. Disclaimer: Not a lawyer, but I dealt with law enforcement requests in Germany in a past job.