Debate: Urgent need for a coordinated European response and legislative framework on intrusive spyware, based on the PEGA inquiry committee recommendations
Date: TUESDAY, 17 OCTOBER 2023
Speaker: Věra Jourová
Language: EN

I propose the Media Freedom Act, because I do believe that the spyware being used against political opponents and journalists is threatening democracy. And in the Media Freedom Act, you know where we are. We are in an advanced stage of the negotiations. I proposed the ban of the usage of spyware against journalists, with very narrow space for exceptions. And now we are entering the phase of trilogue, and I hope I will be able to convince the Member States that what should remain narrow has to remain narrow. And that’s why I also want to thank this House for sustained support on that.  You said many times that you expect the Commission to take action. The Commission can do two things: either to legislate – and here we can consider, of course, an update of, for instance, the Cybersecurity Act, which should be updated in 2026, or urgent updates of some other pieces of legislation. But again, within the competences we have been given by the Treaty. The second thing we can do is the infringement. Here again, we cannot address individual cases which you mentioned here. This is not the role for the Commission. We are not judges. We don’t have any investigative powers to go into individual cases. I am glad it is set up that way. This is the work for the Member States and the Court’s scrutiny, and I think that we have to leave it like that. Again, I hear I speak about individual cases.  So just to give you a more concrete idea about our mapping, which we did to understand how the conditions are being fulfilled from a data protection perspective. We sent letters to all the Member States at the end of December 22nd, about the legal framework governing the use of spyware to examine the interplay with EU data protection law from a data-protection perspective. 24 Member States have replied up to now, except Denmark, Hungary and the Netherlands. Due to the varying quality and content of their replies, this mapping exercise constitutes a first step in the reflection, and the Commission will continue working on that. We will keep asking and here is the sentence which provoked negative reactions. Here we are going to explore further the possibility of presenting a non-legislative initiative, clarifying the boundaries and the interplay between EU law, in particular the data protection and privacy  You also mentioned the dual use and trade aspect. Let me clarify that intrusion software such as Pegasus is already subject to control under the Dual-Use Regulation. This means that any exports of Pegasus or related software must be subject to an authorisation granted by competent authorities of the Member States. We will continue to engage with Member States to clarify their consistent application of the regulation, and are also discussing with Member States the additional information they should report on authorisations for cyber surveillance items in view of the preparation of the 2023 Annual Report and enhanced transparency requirements of the new regulation. I have some more things to say, but I think I am beyond time.