- The BND has to immediately delete all records except the ones that are relevant for an enumerated set of purposes and has to document this deletion. Per the parliamentary commission's reports [1], the remaining messages are generally a few hundred annually.
- The BND can only share them with law enforcement for the prevention and prosecution of an enumerated list of serious crimes. Using them for other purposes it not allowed, and evidence obtained as the result of such illegally shared information is to be excluded by the courts [2].
- The BND has to notify anybody whose messages have not been deleted immediately that some of their telecommunication has been intercepted. This has to occur within 12 months, unless the G10 commission authorizes a deferral of the notification. The annual report of the parliamentary commission lists how many people were and were not notified.
The BND is subject to these constraints, the NSA isn't.
Furthermore, if the BND breaks the law, remedies are available; Germany does not have any recourse against NSA actions.
[1] E.g.: http://dip21.bundestag.de/dip21/btd/17/127/1712773.pdf
[2] BGH, 2 Str 731/79. http://www.ejura-examensexpress.de/online-kurs/entsch_show_n...