2.

Decides that the committee of inquiry shall: — investigate the scope of alleged contraventions, or maladministration in the implementation, of Union law, resulting from the use of the Pegasus and equivalent surveillance spyware, collect information on the extent to which Member States, including but not limited to Hungary and Poland, or third countries use intrusive surveillance in a way that violates the rights and freedoms enshrined in the Charter, as well as assess the level of risk this poses to the values enshrined in Article 2 TEU, such as democracy, the rule of law and respect for human rights; — for the performance of its duties, collect and analyse information to ascertain: — the use and the functioning of the Pegasus and equivalent surveillance spyware and its alleged negative impact on fundamental rights under the Charter, in cases where Member States were implementing Union law; — the existing legal framework in which Member States have acquired and used the Pegasus and equivalent surveillance spyware; — whether Member States’ authorities have used the Pegasus and equivalent surveillance spyware for political, economic or other unjustified purposes to spy on journalists, politicians, law enforcement officials, diplomats, lawyers, business people, civil society actors or other actors, in violation of Union law and of the values enshrined in Article 2 TEU, or the rights enshrined in the Charter; — whether the use, in contravention of Union law, of the Pegasus and equivalent surveillance spyware had an adverse impact on democratic processes in the Member States concerning elections on local, national and European levels; — the alleged contraventions or maladministration by Member States, resulting from the use of the Pegasus and equivalent surveillance spyware, of Directive 2002/58/EC, in particular regarding the principle of confidentiality of communications and the prohibition of listening, tapping, storage or other kinds of interception or surveillance of communications and the related traffic data of persons; — whether the use of the Pegasus and equivalent surveillance spyware by Member States have constituted, resulted in or revealed violations of Directive (EU) 2016/680 and Regulation (EU) 2016/679; — whether the Commission had evidence of the use of the Pegasus and equivalent surveillance spyware against persons; — whether the Member States have ensured sufficient institutional and legal safeguards to avoid the illegal use of spyware, and whether persons who suspect that their rights have been violated by the use of spyware have access to effective remedy; — the alleged failure of Member States to act in respect of the involvement of entities in the EU in the development, dissemination, or financing of the Pegasus and equivalent surveillance spyware, including the supply chain in terms of technology and its exploitation, in so far as it is in breach of Union law, including Regulation (EU) 2021/821, and including where surveillance software marketed for a certain purpose (e.g. fight against terrorism) is used in another context; — the role of the government of Israel and of other third countries in supplying the Pegasus and equivalent surveillance spyware to Member States; — whether the use of the Pegasus or equivalent surveillance spyware by Member State authorities has resulted in the transfer of personal data to third countries, in particular but not limited to it, to the NSO Group, as well as to third countries’ governments; — whether the use of the Pegasus or equivalent surveillance spyware, directly or indirectly involving entities linked to the EU, contributed to illegal spying on journalists, politicians, law enforcement officials, diplomats, lawyers, business people, civil society actors or other actors in third countries and whether it led to human rights violations or abuses that are of serious concern as regards the objectives of the EU’s common foreign and security policy, and whether such use was in contravention of the values enshrined in Article 21 TEU and in the Charter, also with due regard to the United Nations Guiding Principles on Business and Human Rights and other rights enshrined in international human rights law; — whether there were sufficient grounds for the Council to adopt restrictive measures or sanctions in the framework of the EU common foreign and security policy against one or more third countries where a decision, adopted in accordance with Chapter 2 of Title V TEU provided for the interruption or reduction of economic or financial relation, in accordance with Article 215(1) TFEU; — whether the use of the Pegasus or equivalent surveillance spyware by third countries had an impact on fundamental rights ensured under Union law and whether, there were sufficient grounds for the Council to reassess any international cooperation agreements in the Area of Freedom, Security and Justice concluded with third countries pursuant to Article 218 TFEU; — make any recommendations that it deems necessary in this matter; — make recommendations for protecting EU institutions and its Members and staff against such surveillance spyware;