No constitutional law expert myself, trying to contextualize in the hope it helps:
Core pillars of the German constitutional system are informational self-determination (i.e. personal data has a very high degree of protection under the constitution, see Germany's history) and proportionality (in using its powers, the state must choose methods appropriate to specific situations, obv. to hinder misuse of power - see Germany's history again).
So the ruling in essence, as I understand it, says among other things:
1. Automated data analysis needs to respect informational self-determination of anyone (i.e. no data mining per se on people who are not suspects for a given type of crime being investigated)
2. Automated data analysis needs to be proportional, meaning that the purpose of running any analysis "for the benefit of the public" must be reasonably well established and the analysis must have a strict goal.
I.e. if John stole something, you have to analyse the data such that you can credibly prove that identification for theft was the purpose.
Starting with looking for thieves but ending up identifying X movie pirates, Y weed consumers etc. is not proportional and crosses the right to informational self-determination.
So in the above example, the movie piraters and weed smokers might have not had an official investigation into their offenses on record, so by law the presumption of innocence must hold - you cannot do blanket investigations without reasonable cause under German law.
In the final paragraphs, the text actually states under which conditions automated data analysis would fullfil constitutional requirements:
1. The legislative needs to codify which data points exactly can be used for a given offense where offenders are to be identified with data analysis. Laws also need to explicitly codify limits of usable data.
2. If automated data analysis is performed by authorities, they must document the reason for initiating an analysis, the methods chosen, the criteria for labeling the outputs as "guilty/innocent", document the entire procedure and be able to release all of it to the public domain so that public data protection officers - or anyone else - can audit the results.
All of this sounds super reasonable to me.
To be clear, automatic data analysis for the purpose of extreme threats to national or public security are exempt if I understand correctly. These would be cases where it is proportional to perform such analyses for the greater good.
But you cannot do mass number crunching on ordinary citizens.
Yay in my book.