Debate: Urgent need for a coordinated European response and legislative framework on intrusive spyware, based on the PEGA inquiry committee recommendations
Date: TUESDAY, 17 OCTOBER 2023
Speaker: Věra Jourová
Language: EN

Unfortunately, we continue getting media reports on the intrusive use of spyware by foreign, but also by some European, authorities. So let me be very clear, the Commission strongly condemns any illegal access to interpersonal communications. Any attempts by national security services to illegally access the data of citizens, including journalists and political opponents, if confirmed, is unacceptable. Spyware is a particularly intrusive technology. It is paramount that the fundamental rights to privacy and data protection, as enshrined in EU law, are fully respected all over the Union. There is already an EU legal framework that applies to the use of spyware in a number of situations.  It is, first of all, EU data protection law, which is fully applicable to the processing of personal data by private entities, even where such processing is required by law for national security purposes. In this case, the supervision of the necessity and proportionality of such processing falls under the remit of the Court of Justice of the European Union. EU data protection law is also applicable when public authorities process personal data for law enforcement and criminal justice purposes. When law enforcement authorities use spyware for these purposes, the Data Protection Law Enforcement Directive fully applies.  It is the Member States responsibility to define and protect their national security interests. However, national security is not a blank check excuse for all use cases of spyware. The Court of Justice made clear that Member States must be able to demonstrate that their national security would be compromised in the case at issue. Member States cannot refer to national security in a general way to exclude the application of EU law, and the Member States responsibility for national security cannot lead to departing from EU standards and basic safeguards. Following the work of the PEGA Committee, the Commission also collected information from the Member States about the legal framework governing the use of spyware. So now we are analysing this input, and we are currently looking at the ways to clarify the boundaries of national security and interplay between EU law, in particular the data protection and privacy  As the Commission will explain in its reply to the Parliament’s resolution, we are exploring the possibility of a non-legislative initiative and we fully agree with you that clarity on this issue is needed.  Honourable Members, data protection and privacy is not the only means by which the Commission is addressing the use of spyware. The 2023 Rule of Law report underlines that even where the use of surveillance software is linked to national security, there is a need for national checks and balances to ensure that safeguards are in place. In this regard, where relevant, the country chapters have included the functioning of national checks and balances for concerns over investigations into the use of spyware. This happened also in previous editions of the report on the Rule of Law.  The Commission also introduced specific safeguards in the proposal for a European Media Freedom Act. We proposed a special provision to further restrict the use of spyware against media-services providers and journalists, beyond the restrictions applying to other forms of surveillance. The discussions on this file are ongoing and I count on the support of this House on this issue.  The ePrivacy Directive prohibits the interception of communications and the storage of, and access to, information in the terminal equipment without the prior consent of the user concerned. And where Union law is not applicable, Member States are bound by the guarantees laid down in the European Convention on Human Rights. The Commission agrees with Parliament that the ePrivacy Regulation is urgently needed, and is supporting the co-legislators in the legislative negotiations on the ePrivacy Regulation.  Next, the proposal for a Cyber Resilience Act aims to establish cybersecurity requirements for hardware and software accessing the European market, and sets out corresponding obligations for the manufacturers of these products. It will therefore – I got lost. No, I am missing a page, but I am beyond the time anyway, so I will complete it at the end – Can I complete it at the end, Mr President? Okay. Thank you very much. This has happened for the first time in nine years.