Debate: The Pegasus spyware scandal
Date: WEDNESDAY, 15 SEPTEMBER 2021
Speaker: Didier Reynders
Language: FR

Plusieurs rapports récents indiquent que certains services nationaux de sécurité ont utilisé le logiciel d’espionnage Pegasus pour accéder directement aux appareils de citoyens, y compris des journalistes et des opposants politiques. Permettez-moi tout d’abord de déclarer que la Commission condamne fermement tout accès illégal aux systèmes ou toute forme d’interception illégale des communications des utilisateurs. En fait, c’est un crime dans toute l’Union grâce à la directive relative aux attaques contre les systèmes d’information. La Commission a déjà souligné la nécessité de mettre en place une stratégie de cyber sécurité solide et une forte protection des droits fondamentaux tels que le droit à la vie privée et la protection des données personnelles, qui sont ses principales priorités. La directive vie privée et communications électroniques («e-privacy») garantit le droit à la vie privée et à la confidentialité des communications électroniques. Cette directive interdit en principe l’interception ou la surveillance des communications sans le consentement des utilisateurs concernés. De plus, la directive protège l’intégrité des équipements terminaux des utilisateurs – ordinateurs portables, téléphones mobiles, etc. Généralement, le consentement de l’utilisateur est requis pour stocker des informations ou pour accéder à des informations déjà stockées sur l’équipement terminal de l’utilisateur, à quelques exceptions qui ne sont pas pertinentes ici. La Cour européenne de justice a confirmé que les États membres ne peuvent restreindre la confidentialité et l’intégrité des communications qu’à des fins strictement limitées et sous réserve des principes de nécessité et de proportionnalité, sur la base des obligations prévues par la loi et soumises à des garanties matérielles et procédurales strictes. Le règlement vie privée et communications électroniques renforcera davantage la confidentialité des communications et la protection de l’intégrité des équipements terminaux des utilisateurs finaux. Entre autres, le règlement renforcera les pouvoirs d’exécution des autorités et augmentera le niveau des amendes. Il est donc essentiel que le Parlement et le Conseil s’accordent très rapidement sur un compromis concernant ce texte législatif très important. In addition, processing of personal data falls, in principle, within the scope of the General Data Protection Regulation and the Data Protection Law Enforcement Directive. If the purpose is the prevention, investigation, detection, or prosecution of criminal offences and the processing is carried out by competent authorities, such as authorities tasked with the criminal investigations, the controllers have just to comply with all the obligations laid down in the GDPR or the Law Enforcement Directive in addition to the e-privacy rules. Data processed by public authorities for national security purposes may fall in certain cases outside the scope of EU data protection laws. In any case, the privacy of communication and the protection of personal data is always subject to strict safeguards under the European Convention on Human Rights and the constitutional laws of the Member States. It is for national authorities to demonstrate that such processing is necessary and proportionate for national security purposes. The national competent authorities are in charge of the enforcement of data protection and privacy rules under the control of the courts. It is precisely because the European Union has adopted data protection rules such as the ePrivacy Directive, the GDPR and the Law Enforcement Directive that the competent authorities can take action against privacy or personal data breaches. The report on the Pegasus breaches, in fact, shows the need for such rules. The Commission is following the matter closely. We understand that the Hungarian Data Protection Authority launched an  ex officio investigation into the Pegasus case on 5 August and that it has the power to investigate matters related to the secret surveillance and processing of classified information. It is expected that the Hungarian Data Protection Authority will release further information once the investigation is concluded. The normal duration of such an investigation is two months, which can, however, be extended in order to give the controllers time to answer information requests. Currently the Commission is taking specific measures to improve the cybersecurity of connected devices, including by way of a delegated act under the Radio Equipment Directive which is expected to be adopted soon. The mix of measures envisaged by the new EU Cybersecurity Strategy, issued in mid-December 2020, will allow operators, especially critical ones, to shore up their cybersecurity defences, with particular attention to securing their supply chain and relying on solutions secured by design. Together with the new EU cybersecurity strategy, on 16 December 2020 we made a proposal for a revised NIS Directive to enhance the cyber-resilience of entities and networks. The NIS II proposal raises the EU common level of ambition on cybersecurity through a wider scope, clearer rules and stronger supervision tools. In addition, the Commission announced in the new strategy that it would explore new horizontal rules to improve the cybersecurity of all connected products and associated services placed on the  internal market. Such rules could include a new duty of care for connected-device manufacturers to address software vulnerabilities, including security updates, and ensuring deletion of sensitive data at the end of life. Moreover, the Directive on attacks against information systems requires all Member States to ensure that the illegal access to information systems and illegal interception are defined as criminal offences in their national criminal law and that high common levels of penalties for these offences are in place as a deterrent effect. Still on cybersecurity, let me come back to what President von der Leyen put forward during the State of the Union speech before this Parliament this morning. She made clear that we should not just be satisfied with addressing the cyber threats but also strive to become a leader in cybersecurity. This is why we need a European cyber defence policy, including legislation on common standards under a new European Cyber Resilience Act. Protecting journalists and media professionals against online threats or illegal surveillance will be part of an upcoming recommendation on the safety of journalists announced under the European Democracy Action Plan, scheduled to be adopted tomorrow. The recommendation will highlight the importance of cooperation between online platforms and organisations with expertise in tackling threats against journalists, as well as the role of national cybersecurity bodies in helping journalists in those kinds of situations. To conclude, as more information is becoming available on the Pegasus case, we continue looking closely into the matter. No illegal access to information or communication systems or any kind of illegal interception to users’ communications or devices is allowed in the European Union. The Union has a robust data protection and privacy acquis, which needs to be respected with the collaboration of all concerned. We count on the close cooperation of all relevant authorities in order to ensure that all fundamental rights are respected. Thank you very much for your attention, but of course I am looking forward to hearing your remarks, observations and interventions.