Debate: Recent revelations of spying on Members of the European Parliament and the lack of follow up on the PEGA committee recommendations
Date: TUESDAY, 27 FEBRUARY 2024
Speaker: Jutta Urpilainen
Language: EN

We consider that any attempt to illegally access the data of citizens, including Members of this House and staff of EU institutions, if confirmed, is unacceptable. The Commission has taken note of recent revelations alleging that Members and staff of this House were targeted by mobile phone surveillance software, and this is especially worrying as we are approaching the elections for Parliament. As the Commission recently affirmed in its December recommendation on elections, surveillance and spyware tools must not be used to interfere with the democratic debate. The use of spyware can, under certain conditions, be a matter of national security. Such tools can be important weapons against crime, for instance when combating terrorism or high-level criminal networks.  But using spyware has to be duly justified. Spyware is a particularly intrusive technology, and its use requires the highest standard of scrutiny. We have sought to address this issue in several recent legislative proposals. There are strong specific safeguards for journalists and media professionals in Article 4 of the recently agreed European Media Freedom Act. The ePrivacy Directive prohibits the interception of communications and the storage of and access to information in terminal equipment without the prior consent of the users concerned. Where the Directive is not applicable, Member States are bound by the guarantees laid down in the European Convention on Human Rights and by their national law. In its 2023 Rule of Law report, the Commission underlines that even where the use of spyware is linked to national security, there is a need for national checks and balances to ensure that safeguards are in place.  Our other recently agreed instrument, the Cyber Resilience Act, aims to establish cybersecurity requirements for the market access in the EU of hardware and software, and sets out corresponding obligations for the manufacturers of these products. It will further contribute to reducing the attack surface of hardware and software that spyware is trying to exploit.  We are continuing our efforts to strengthen export controls on cybersurveillance items from the EU to third countries under the term of the modernised Dual Use Regulation of 2021. As announced in this House, the Commission will bring forward a text clarifying the boundaries of and the interplay between EU law, in particular the data protection and national security, and this has been explained in the Commission official reply to the Parliament resolution on the issue.  We believe that EU data protection law is fully applicable when fundamental freedoms come into play through the processing of personal data by private entities, and when law enforcement authorities process personal data for law enforcement and criminal justice purposes. Where data protection law does not apply, Member States are bound by the guarantees laid down in the European Convention of Human Rights and in their national law.  Finally, we welcome efforts across the institutions to provide more robust defences and checks to ensure that any attempts to spy on democratic processes are quickly identified and addressed. Thank you very much for your attention, and I am looking forward to our debate.