Debate: The lack of legislative follow-up by the Commission to the PEGA resolution
Date: WEDNESDAY, 22 NOVEMBER 2023
Speaker: Didier Reynders
Language: EN

We understand that in your resolution, you are calling on the Commission to present a plan of measures to prevent the abuse of spyware in the European Union, making full use of all available legislative and non-legislative means provided by the Treaties.  I believe that today’s presentation gave you already an overview of some measures already proposed. Let me first reiterate that the Commission considers that any attempt by national authorities to access citizens’ data illegally, including that of journalists or political opponents, is unacceptable and should be condemned.  So, first of all, I want to say that the Member States should make sure that their security services respect rules. But when I am speaking about Member States, it is not just the government. I am speaking also about independent data protection authorities that we are supporting, and also the independent judiciary. And you know that also we are supporting the independent judiciaries, and we try to work in the different Member States to guarantee the independence of the judiciary. So, it is not just to speak about the Member States as government. We are speaking also about very clear other entities that are able to act in such a kind of situation, and certainly on data protection, privacy and on security of journalists and fundamental rights, in particular the freedom of expression.  I want to confirm that we have taken also some legislative initiatives. I do not want to repeat what I have said in my introduction, but you are now discussing the European Media Freedom Act. And there there are some provisions about the journalists and the possible use of spyware.  The same about the Cyber Resilience Act, another legislative initiative that is on the table. Of course, for the rest, I have said that enforcement is primarily a national competence of the relevant law enforcement agencies of the Member States. But, until recently, there was no legal basis for any discussion and adversary action at the EU level in this area. The new Dual-Use Regulation, however, changes this approach and introduces dedicated provisions on enforcement as part of the overall thrust towards a more effective EU export control system.  Under the terms of the new regulation, the Commission has recently, in 2022, set up a so-called enforcement coordination mechanism, which is mandated with the preparation of concrete actions, for example, for enhancing information exchange between licensing and enforcement agencies. There also we have some capacity to act with the national agencies able to react in such a kind of situation.  Of course, I have listened to a lot of comments about the use of spyware against citizens. I don’t want to repeat again that it’s unacceptable, but I have listened and saw the necessity to use some kind of spyware or other equipment in the national security issues. Certainly in the geopolitical situation that we are living in for the moment, with the war in Ukraine and the situation in the Middle East, it is quite important that some actors at the national level have the capacity to act with different intrusive instruments to defend the national security.  I want just to insist on the fact that when you compare with the situation in the US, the US is not a union, it’s a federal state. When we are listening about some decisions taken in the US, those decisions are taken just on the basis of the national security competence of the federal government. I have had many discussions with our US colleagues and again, that’s an exception in the Treaty and is more a competence of the Member States. But I have said myself that there are some limits in the way to use different kind of instruments also in national security.  In addition to the existing rules and to the proposal I referred to, we are preparing, as I said, a non-legislative initiative. This initiative would clarify the boundaries of and the interplay between EU law, in particular the data protection, a privacy acquis and national security. Of course, we will keep you fully informed about this proposal, and I am sure that we’ll have to go back to such a debate with, in our mind, the different provisions of the Treaties and the different competence at different levels that I have described: the EU level, but also the level of the Member States.