The Pegasus Spyware scandal and the competences of the European Commission in practice

This research paper examines the exercise of competences of the European Commission in light of the Pegasus spyware scandal. In 2021, the “Pegasus Project†revealed the illegal surveillance of more than 50000 devices worldwide, including those of EU citizens. The consultation of a combination of publicly available documents, media reports and EU law showed that, on the supranational level, the European Parliament’s “Committee of Inquiry to investigate the use of Pegasus and equivalent surveillance spyware†investigated the Pegasus spyware scandal and infringements of fundamental rights, which resulted in the adoption of recommendations for further action. In view of the threat to European values and the rule of law, the Parliament identified a scope of action for the European Commission. Whilst the European Commission is equipped with a wide-ranging toolbox that would allow for an array of legislative actions to be taken, the European Commission is hesitant to act. This lack of response from the European Commission can be attributed to the novelty of the Pegasus scandal itself and its positioning between national security and digital policy. It is the conflicting interests of EU member state governments and the different degrees of being affected by potential EU regulation which impacts national and consequently European positions. Additionally, political and economic framework conditions, such as the elections to the European Parliament from 06 to 09 June 2024, must also be taken into account.