Civil society groups across Europe have released a joint statement calling on EU institutions to regulate spyware technologies.

Among the 30 signatories is the Centre for Democracy and Technology Europe, (CDT EU), the Electronic Privacy Information Center, the European Federation of Journalists, and Wikimedia Europe.

In their statement, the coalition demands action on intrusive modern spyware tools, claiming they could already be made illegal under existing EU laws that protect citizens rights to privacy and data protection.

Urging immediate regulation from incoming EU institutions in the new legislative term, the coalition calls for a ban on the production, sale, and use of spyware tools, and expresses concern over the reluctance of EU governments and institutions to address the misuse of spyware technology.

They set out a series of recommendations for top level EU institutions, including asking the EU Commission to propose a new legal framework to address spyware, and push for the implementation of a complete ban on the development and sale of commercial spyware by private companies.

The statement also wants individual EU member states to impose sanctions on vendors found to have been utilising or allowing the use of spyware against EU law, as well as suspending all exports out of the EU on the sale and transfer of surveillance technology that breaches international human rights standards. 

Making note of the European Parliament inquiry into the extensive use of Pegasus and other spyware by EU states, the coalition criticises the recently adopted European Media Freedom Act (EMFA) for failing to protect journalists from spyware, writing that it lacks safeguards against their surveillance and creates sweeping legal grounds for its use against them by EU states.

Recommended reading

• NCSC Warns Organisations to Prepare for Long Ukraine Conflict
• UK Gov at Risk of “Catastrophic” Ransomware Attack
• 82% of Firms Say the Exposure Management Gap is Widening

Silvia Lorenzo Perez, director of CDT Europe’s security, surveillance and human rights programme, said: “The incoming EU institutions have the opportunity to correct the failures of the last legislature by taking concrete and decisive action against the abuse of spyware surveillance by governments and law enforcement agencies in the EU.”

The European Data Protection Supervisor has already expressed doubts about the legality of modern spyware tools under EU law in a report from 2022, which stated that spyware tools like Pegasus could be replaced by more traditional tools for law enforcement.

Recently, the UK and France announced the launch of a consultation under the Pall Mall Process to explore policy options and new practices addressing the threat of ‘off-the-shelf’ spyware and cyber-proliferation tools.