Debate: Investigation of the use of Pegasus and equivalent surveillance spyware - Investigation of the use of Pegasus and equivalent surveillance spyware
Date: WEDNESDAY, 14 JUNE 2023
Speaker: Didier Reynders
Language: FR

Nous étudierons avec soin les recommandations adoptées par votre Parlement et nous nous tenons prêts à y donner les suites opportunes. Je suppose qu’il en va de même pour le Conseil, même si celui-ci n’a pas été invité pour ce débat. La Commission a suivi avec une grande attention les travaux de la commission PEGA. Entretemps, nous avons déjà pris des mesures. The Commission has already made clear that it condemns any illegal interference in personal communications as it goes against democratic values and undermines fundamental rights. We expect that national competent authorities and courts make full use of their powers to totally investigate the allegations regarding any unlawful surveillance activities and to restore citizens trust. Spyware is a particularly intrusive technology. It is paramount that the fundamental rights to privacy and data protection, as enshrined in EU law, are fully respected all over the Union. The legal framework governing the use of spyware can differ depending on whether its use falls under EU law or national law.  Comme je l’ai déjà évoqué, dans les cas où le droit de l’Union s’applique à l’utilisation d’un logiciel espion, la confidentialité des communications et des données personnelles est protégée par le règlement général sur la protection des données, la directive «police-justice» et la directive vie privée et communications électroniques. Les autorités de surveillance et les juridictions nationales sont compétentes en vertu de ces instruments pour garantir le respect effectif de ce cadre législatif. Le droit de l’Union relatif à la protection des données continue à s’appliquer en ce qui concerne le traitement des données à caractère personnel par des entités privées, même lorsque ce traitement est requis par la loi à des fins de sécurité nationale. De même, le droit de l’Union est aussi applicable lorsque les autorités publiques traitent des données à caractère personnel à des fins répressives et pénales. Ainsi, lorsque les services répressifs utilisent des logiciels espions pour de tels objectifs, la directive «police-justice» s’applique. Dans ces situations, les personnes physiques doivent être en mesure d’exercer leur droit à la protection des données, tel que prévu par le droit de l’Union, ce qui inclut le droit à l’information et celui à un recours juridictionnel effectif. La Commission insiste sur l’importance, pour les autorités de contrôle et les autorités judiciaires nationales, de disposer de compétences suffisantes et des moyens nécessaires pour les exercer. Il est essentiel que ces autorités fassent pleinement usage de l’ensemble de leurs pouvoirs pour examiner de manière approfondie toute allégation de violation de droits en ce domaine. However, as you know, EU law does not apply to cases where public authorities directly access the data, so not via a telecom operator and process them for genuine national security purposes, which is a different issue than law enforcement. An important question in this debate is therefore the delineation between the application of EU law and national rules on national security, as the PEGA Committee has also underlined. It is for the Member States to define their national security interests and to adopt appropriate measures to ensure their national and external security. Nevertheless, the European Court of Justice made clear that Member States must be able to demonstrate that national security would be compromised in the case at issue. The Court of Justice also held that threats relating to national security are the ones that are capable of seriously destabilising the fundamental constitutional, political, economic and social structures of a country such as terrorist activities. Based on the Court case-law. Therefore, Member States cannot merely refer to national security in a general way to exclude the application of EU law. In cases reported by the press, the real issue seems to be whether the use of such spyware is generally justified by national security in the individual cases at hand. When such a restriction to the right to privacy and personal data protection cannot be justified as falling under national security, EU law must apply with all the requirements it provides. It is also important to bear in mind that where EU law is not applicable, the European Convention on Human Rights still applies as well as national constitutional-law safeguards.  Honourable Members, the Commission has been gathering information from all the Member States about the national legal frameworks governing the use of spyware in order to examine the interplay with EU data protection law. Most Member States have replied except the Netherlands and Hungary, and we are following up with Member States whose replies are still outstanding. We are carefully analysing the responses received. This exercise requires putting Member States responses in the context of their relevant national framework. It is important to consider the following points where Member States have in place national legislation framing the use of tools such as spyware for national security purposes: whether the national legislation provides for specific and sufficient safeguards, given the high level of intrusiveness of the use of surveillance tools. The report of the committee highlights the alleged use of spyware against journalists in several Member States. As you may recall, this led the Commission to introduce specific safeguards in the proposal for European Media Freedom Act. We propose a special provision to further restrict the use of spyware against media service providers and journalists beyond the restrictions applying to other forms of surveillance. The discussions on this file are ongoing in the European Parliament and in the Council. The proposal for a Cyber Resilience Act tabled by the Commission in September last year, also aims to address some of the challenges of supply chain security and to ensure that digital products present on the European market are sufficiently secure. We also acknowledge the concerns regarding media reports about certain Member States exporting spyware to third countries with authoritarian regimes leading to possible human rights violations.  The new Dual-Use Regulation in force since 2021 reinforced the reporting on export of cybersecurity items, including spyware. Still, Member States are in charge of granting export authorisations. According to the Dual-Use Regulation, Member States are obliged to report individual denials, but not authorisations. Having said that, the Commission continues working with the Member States to obtain their assurance of a proper implementation of EU legislation. Furthermore, in line with the current Action Plan on Human Rights and Democracy, the EU committed to uphold and advance human rights around the world, online and offline. The European Union’s position regarding unlawful online surveillance is firm. States should implement legislation and safeguards to protect people from unlawful surveillance, including any arbitrary or mass surveillance that may be carried out by State actors in cyberspace as well as in the physical world. Any such policies have to be fully in line with international human rights law. So, of course, I am now looking forward to your debate. And again, the Commission will try to see how it’s possible to implement the recommendations that you will vote at the end of such a debate.