Debate: The lack of legislative follow-up by the Commission to the PEGA resolution
Date: WEDNESDAY, 22 NOVEMBER 2023
Speaker: Didier Reynders
Language: EN

We spoke also about our reply to Parliament’s resolution of June this year. I am pleased to confirm that our reply has been formally transmitted to Parliament. Today, I would like to underline again that the Commission strongly condemns any illegal access to interpersonal communications and other data stored on users’ devices whoever the authors of such illegal access are. Any attempt to illegally access the data of citizens, including journalists and political opponents, if confirmed, is unacceptable. Spyware is a particularly intrusive technology. If misused, it strikes against our core values. It is of utmost importance that the internal market rules and the fundamental rights to privacy and data protection, as enshrined in EU law, are fully respected all over the Union. This is why, as we announced last month, we are currently preparing a non-legislative initiative clarifying the boundaries of and interplay between EU law, in particular the data protection and privacy acquis, and national security. And we hope to have your support on this. To be a bit more specific, let me recall that EU data protection law is fully applicable to the processing of personal data by private entities, even where such processing is required by law for national security purposes. In this case, the supervision of the necessity and proportionality of such processing falls under the remit of the Court of Justice of the European Union. EU data protection law is also applicable when law enforcement authorities process personal data for law enforcement and criminal justice purposes. In that specific case, the Data Protection Law Enforcement Directive applies. EU data protection law does not apply to activities of the state authorities in the areas of defence and national security. Where EU data protection law is not applicable, Member States are bound by the guarantees laid down in the European Convention on Human Rights and in their national law, including their constitutional provisions. So, Member States’ responsibility for national security cannot be used to depart from EU standards and basic safeguards. Member States’ responsibility to define and protect their national security interests is not a blank cheque issued for all use cases of spyware. It is notably important for the national legal framework to provide for adequate safeguards and controls, including possible judicial review. Under EU law, as clarified by the Court of Justice, in order to justify a restriction to rights provided by EU law, Member States must demonstrate that national security or another legitimate public interest would be compromised in the case at issue and cannot refer to national security in a general way to exclude the application of EU law. The attention given to the issue in 2023 Rule of Law Report underlines that even where the use of surveillance software is linked to national security, there is a need for national checks and balances to ensure that safeguards are in place. In this regard, the relevant country chapters of the report have included the functioning of national checks and balances for concerns over investigations into the use of spyware. The Commission has also sought to reflect the need to address this issue in several recent legislative proposals. There are specific safeguards in Article 4 of the proposal for a European Media Freedom Act. We propose a special provision to further protect media service providers, including journalists, against the use of spyware. This protection would go further than the protection against other forms of surveillance. The discussions between co-legislators are advancing, and we count on the support of Parliament for a swift agreement on this file. The ePrivacy Directive prohibits the interception of communication and the storage of and access to information in the terminal equipment without the prior consent of the user concerned. This directive does not apply to activities of the state authorities in the areas of defence and national security. Where the ePrivacy Directive is not applicable, Member States are bound by the guarantees laid down in the European Convention on Human Rights and by their national law. The proposal for a Cyber Resilience Act aims to establish cybersecurity requirements for the market access in the EU of hardware and software and sets out corresponding obligations for the manufacturers of these products. It will therefore further contribute to reducing the attack surface of hardware and software that spyware is trying to exploit. We are continuing our efforts to strengthen export controls on cyber surveillance items from the EU to third countries under the terms of the modernised Dual-Use Regulation of 2021. Any such cyber surveillance items cannot leave the EU territory without an export authorisation or licence issued by the competent authority of the Member States. Once again, the Commission would like to reiterate that it condemns any illegal interference in personal communications as it is contrary to democratic values and undermines fundamental rights in the European Union. Any attempts by national authorities to illegally access data of citizens, including journalists and political opponents, is again unacceptable. We expect national competent authorities and courts to make full use of their powers to thoroughly investigate allegations regarding any unlawful and lawful surveillance activities. The Commission has no investigative powers. We cannot assess whether national security was at stake in individual cases. We have no access to the relevant files and no competence in this area. What we can do is to look at the safeguards that are in place at national level, and I have described what is possible to ask in the different national legislations. I want to thank you for your attention. Of course, I will listen to your remarks and if there are some critics, I will listen too.