MEPs debate recommendations to tackle and prevent spyware abuse in Europe, based on the inquiry into illicit use of Pegasus and other spyware. The recommendations set out a range of proposals, including investigations into suspected abuse; EU standards for the deploy of spyware; legal remedies for people who have been targeted; strict enforcement of the EU’s export control rules; an EU Tech Lab to conduct technical investigations; and co-ordination with third countries. Opening statements by Sophia IN 'T VELD (Renew, NL), Rapporteur and by Didier REYNDERS, European Commissioner for Justice.

statement

Strasbourg

debate

fight against cyber attacks (T)

IN 'T VELD, Sophia (Renew, NL)

joint debate

REYNDERS, Didier (BE, EC)

Committee of inquiry to investigate the use of the Pegasus and equivalent surveillance spyware

Pegasus spyware: opening statements by Sophia IN 'T VELD (Renew, NL), Rapporteur and by Didier REYNDERS, European Commissioner for Justice

SOUNDBITE (English), Sophia IN 'T VELD (Renew, NL), Rapporteur, Madam Chair, Dear colleagues, today we are going to have to debate and tomorrow to the vote on the recommendations put forward by the peak Committee, which is the conclusion of the work that we have been doing for 14, 15 months. And let's go back a little bit. What it is that we're talking about, spyware, you know, this stuff that creeps into your phone, into your mobile phone and takes over your life without you even noticing it.

SOUNDBITE (English), Sophia IN 'T VELD (Renew, NL), Rapporteur, And of course, we've been focusing a lot on what this means to the individual whose privacy is violated in the most horrible way. But I think what may be even more important is what this means for democracy, because spyware is not just a technology. It is a tool in a broader toolkit, the toolkit of the authoritarian. It is a grave threat to democracy because spyware is not being used against just any citizen. And this is also why many people think, oh, it doesn't concern me.

SOUNDBITE (English), Sophia IN 'T VELD (Renew, NL), Rapporteur, It concerns only a handful of people that I have nothing to do with. No, it concerns the very people who are the custodians of our democracy, the people who hold power to account, the people who scrutinise. The people who exercise oversight. Journalists, oversight. Bodies. Lawyers. NGOs. Researchers. Opposition politicians. And, you know, I firmly believe that democracy is about checks and balances and accountability and scrutiny.

SOUNDBITE (English), Sophia IN 'T VELD (Renew, NL), Rapporteur, Take those away. And democracy is dead. If you have no more countervailing powers, then democracy is dead. And that is the very purpose of the regimes that are using spyware against some of their own citizens. This is not only happening in Saudi Arabia or Mexico. No, it's happening right here on our doorstep within the European Union, by EU governments. It is a democracy crisis you might say.

SOUNDBITE (English), Sophia IN 'T VELD (Renew, NL), Rapporteur, But let's see a little bit what happens since the news of this broke, which is now almost two years ago, July 2021, when the Pegasus Project presented its report. Justice has not been done in a single case, not a single case, no inquiry, be it parliamentary or judicial or police inquiry, has been concluded in a meaningful way in not a single member State.

SOUNDBITE (English), Sophia IN 'T VELD (Renew, NL), Rapporteur, Has light been shed on the situation? Not a single case of illicit exports has been investigated and not a single licence has been repealed. Colleagues, nothing has been done. Some countries have taken measures, but in most of the cases they are meaningless or they even make matters worse. And I have to say the European Union has also been pretty much absent, with the exception of this House and maybe the European Public Prosecutor's Office.

SOUNDBITE (English), Sophia IN 'T VELD (Renew, NL), Rapporteur, Letters have been written to the member states asking them for explanations, but in a very friendly way. Now, I find the contrast with the response of the European Union to other crises quite stark. You know, we've had we've had a war, we've had a pandemic, we had inflation, we had an energy crisis a bit longer ago. We had the banking crisis. And every time, you know, the European Union is there with a crisis response.

SOUNDBITE (English), Sophia IN 'T VELD (Renew, NL), Rapporteur, In this case, the crisis is a democratic crisis. Democracy is the core of what the European Union is about. And yet the European Union is absent. Today, Commissioner, we are adopting a comprehensive set of recommendations and I would really ask the commission to follow up. As much as you can really seek the limits of your powers.

SOUNDBITE (English), Sophia IN 'T VELD (Renew, NL), Rapporteur, And in any case, report back in great detail to the European Parliament, preferably even before the summer break, about how you intend to give a follow up to our recommendations, because this is not the end of our work. This is where it starts. Tomorrow, we're going to adopt the big sledgehammer that we will fighting authoritarianism with, and we will make sure that every single recommendation is implemented, no matter how long it takes. Thank you very much.

SOUNDBITE (French, English), Didier REYNDERS, European Commissioner for Justice, The Commission would like to thank the Pegasus Committee for its report on the presumed use of Pegasus and other surveillance software in the EU. We will study the recommendations adopted by your Parliament, and we will give the do follow up to that. I'm sure the Council will do the same, even if the Council was not invited for this debate.

SOUNDBITE (French, English), Didier REYNDERS, European Commissioner for Justice, The Commission has watched the committee's proceedings keenly throughout the course of that time and it condemns any illegal interference in personal communications as it goes against democratic values and undermines fundamental rights. We expect that national competent authorities and courts make full use of their powers to thoroughly investigate the allegations regarding any unlawful surveillance activities and to restore citizens trust.

SOUNDBITE (French, English), Didier REYNDERS, European Commissioner for Justice, Spyware is a particularly intrusive technology. It is paramount that the fundamental rights to privacy and data protection as enshrined in EU law are fully respected all over the Union. The legal framework governing the use of spyware can differ depending on whether its use falls under EU law or national law.

SOUNDBITE (French, English), Didier REYNDERS, European Commissioner for Justice, As previously stated, where EU law applies in the case of the use of spyware confidentiality of any communications of individuals protected by GDPR. And the directive on police and justice, as well as on the communications. Authorities for surveillance and the national authorities are in charge of monitoring this and making sure that this legal framework is fully implemented.

SOUNDBITE (French, English), Didier REYNDERS, European Commissioner for Justice, EU law in data protection will continue to apply when it comes to the use of personal data by private entities, even if this treatment is necessary for the use of national security. Similarly, EU law applies also when public authorities process any personal data for repressive or penal purposes. In this way, when law enforcement use any type of spyware for this type of objective, the Police Justice Directive applies.

SOUNDBITE (French, English), Didier REYNDERS, European Commissioner for Justice, In this situation, individuals have the right to make sure that their rights are upheld pursuant to EU law. That includes the right to information as well as the right to legal redress. The Commission insists on the importance of control authorities, as well as national legal authorities to have the proper competence in order to enforce just that. It is essential that these authorities fully avail of all of their powers for the purposes of fully and in-depth assessing any violation of rights in this area.

SOUNDBITE (French, English), Didier REYNDERS, European Commissioner for Justice, EU law does not apply to cases where public authorities directly access the data, so not the telecom operator, and process them for genuine national security purposes, which is a different issue than law enforcement. An important question in this debate is therefore the delineation between the application of EU law and national rules on national security, as the PEGA Committee has also underlined.

SOUNDBITE (French, English), Didier REYNDERS, European Commissioner for Justice, It is for the member states to define their national security interests and to adopt appropriate measures to ensure their national and external security. Nevertheless, the European Court of Justice made clear that Member States must be able to demonstrate that national security would be compromised in the case at issue.

SOUNDBITE (French, English), Didier REYNDERS, European Commissioner for Justice, The Court of Justice also held that threats relating to national security are the ones that are capable of seriously destabilising the fundamental constitutional, political, economic and social structures of a country such as terrorist activities. Based on the court caseload. Therefore, member states cannot merely refer to national security in a general way to exclude the application of EU law.

SOUNDBITE (French, English), Didier REYNDERS, European Commissioner for Justice, In cases reported by the press, the real issue seems to be whether the use of such a spyware is generally justified by national security in the individual cases at hand. When such a restriction to the right to privacy and personal data protection cannot be justified as falling under national security, EU law must apply with all the requirements it provides. It is also important to bear in mind that where EU law is not applicable, the European Convention on Human Rights still applies as well as national constitutional law safeguards.

SOUNDBITE (French, English), Didier REYNDERS, European Commissioner for Justice, Honourable Members, the Commission has been gathering information from all the Member States about a national legal framework governing the use of spyware. In order to examine the interplay with EU data protection law. Most member states have replied, except the Netherlands and Hungary and we are following up with member states was replies are still outstanding.

SOUNDBITE (French, English), Didier REYNDERS, European Commissioner for Justice, We are carefully analysing the responses received. This exercise requires putting Member States responses in the context of their relevant national framework. It is important to consider the following points where Member States have in place national legislation framing the use of tools such as spyware for national security purposes whether the national legislation provides for specific and sufficient safeguards given the high level of intrusiveness of the use of surveillance tools.

SOUNDBITE (French, English), Didier REYNDERS, European Commissioner for Justice, The report of the PEGA Committee highlights the alleged use of spyware against journalists in several member states. As you may recall, this led the Commission to introduce specific safeguards in the proposal for European Media Freedom Act. We propose a special provision to further restrict the use of spyware against media service providers and journalists beyond the restrictions applying to other forms of surveillance.

SOUNDBITE (French, English), Didier REYNDERS, European Commissioner for Justice, The discussions on this file are ongoing in the European Parliament and in the Council. The proposal for a Cyber Resilience Act tabled by the Commission in September last year also aims to address some of the challenges of supply chain security and to ensure that digital products present on European markets are sufficiently secure.

SOUNDBITE (French, English), Didier REYNDERS, European Commissioner for Justice, We also acknowledge the concerns regarding media reports about certain member states exporting spyware to third countries with authoritarian regimes leading to possible human rights violations. With the new dual use regulation in force since 2021, we enforce the reporting on export of cybersecurity items, including spyware. Still, member states are in charge of granting export authorisations.

SOUNDBITE (French, English), Didier REYNDERS, European Commissioner for Justice, According to the dual use regulation, member states are obliged to report individual denials, but not authorisations. Having said that, the Commission continues working with the Member States to obtain their assurance of a proper implementation of EU legislation. Furthermore, in line with the current Action Plan on human rights and democracy, the EU is committed to uphold and advance human rights around the world, online and offline.

SOUNDBITE (French, English), Didier REYNDERS, European Commissioner for Justice, The European Union position regarding unlawful online surveillance is firm. States should implement legislations and safeguards to protect people from unlawful surveillance, including any arbitrary or mass surveillance that may be carried out by state actors in the cyberspace, as well as in the physical world. Any such policies have to be fully in line with international human rights law.

SOUNDBITE (French, English), Didier REYNDERS, European Commissioner for Justice, So, of course I will now looking forward to your debate. And again, the Commission will try to see how it's possible to implement the recommendations that you will vote at the end of such a debate. Thank you.