EDPB Confirms Spyware Investigations Following Civil Society Outcry Over EU Surveillance Abuses

The European Data Protection Board (EDPB) has issued a pivotal response to a coalition of civil liberties organizations demanding urgent action against growing spyware abuses across EU member states. This formal reply comes after 34 human rights groups documented cases of governments deploying surveillance tools like Pegasus against journalists, opposition figures, and activists without legal justification.

In its statement, the EDPB explicitly acknowledged that spyware deployments violating data minimization principles constitute GDPR breaches under Articles 5 and 6. The Board emphasized that blanket surveillance of citizens' devices fails both the necessity and proportionality tests required by EU law. Crucially, the response confirms that national data protection authorities (DPAs) have initiated investigations in multiple member states where spyware abuse allegations surfaced.

For affected individuals, unlawful surveillance creates chilling effects on press freedom and political participation. Targeted devices become treasure troves of sensitive information—including location history, communications, and biometric data—falling under GDPR's special category protections. Victims face irreversible privacy harms, with extracted data potentially weaponized for blackmail or public shaming.

Corporate enablers face severe consequences under the response framework. Technology firms providing spyware to EU governments could be liable for GDPR violations under the processor-controller relationship defined in Article 28. Penalties may include fines up to €20 million or 4% of global annual turnover under Article 83, alongside mandatory audits and operational restrictions. The EDPB specifically cited requirements for vendors to conduct human rights impact assessments before deployment.

Three concrete changes emerge from the EDPB's position:

1. Enhanced coordination mechanism: Creation of a dedicated task force enabling cross-border investigations between DPAs when spyware operations span multiple jurisdictions
2. Transparency requirements: New guidelines compelling public disclosure of spyware procurement contracts and deployment statistics
3. Victim support protocol: Standardized procedures for individuals to request device forensic analysis and demand data deletion

The Board's reply references ongoing collaboration with the European Parliament's PEGA Committee investigating spyware abuses and commits to publishing joint recommendations by Q1 2024. This positions GDPR as a critical enforcement tool against unlawful surveillance, with the EDPB pledging to 'use its full powers' against entities violating fundamental rights.

For context, the civil society open letter cited documented cases including:

• Pegasus infections targeting Catalan politicians' phones (Citizen Lab report)
• Predator spyware deployed against Greek journalists (Reporters Without Borders investigation)
• Illegal use of FinFisher software by Hungarian authorities (Human Rights Watch findings)

This regulatory escalation signals that spyware vendors and government users now face GDPR's stringent enforcement mechanisms, with the EDPB explicitly framing privacy as a prerequisite for democratic participation.