Spyware Revelations? EDPS Remarks on Modern Spyware

Editor’s Note: The European Data Protection Supervisor (EDPS) is the European Union’s independent data protection authority, tasked with ensuring that the institutions and bodies of the EU respect data protection law. With the role of ensuring EU institutions and bodies respect people’s right to privacy when processing their personal data, the current EDPS, Wojciech Wiewiórowski of Poland, was appointed as EDPS in December of 2019.

Earlier this month, the EDPS published a communication on the possible impact of modern spyware on the rights to privacy and data protection.  The complete communication is provided below and may be beneficial for cybersecurity, information governance, and legal discovery professionals as they consider the data protection implications of spyware.

Data Protection Update*

EDPS Preliminary Remarks on Modern Spyware

European Data Protection Supervisor

The revelations made about the Pegasus spyware raised very serious questions about the possible impact of modern spyware tools on fundamental rights, and particularly on the rights to privacy and data protection. This paper aims to contribute to the ongoing assessment in the EU and globally of the unprecedented risks posed by this type of surveillance technology. It comes from the EDPS’ conviction that the use of Pegasus might lead to an unprecedented level of intrusiveness, which threatens the essence of the right to privacy, as the spyware is able to interfere with the most intimate aspects of our daily lives.

Introduction Extract

The distribution and use of spyware tools has been a long-standing serious concern to the EDPS, on which he issued Opinion 8/2015 on the dissemination and use of intrusive surveillance technologies. He underlined that “[I]he use and dissemination (including inside the EU) of surveillance and interception tools, and related services, should be subject to appropriate regulation, taking into account the potential risk for the violation of fundamental rights, in particular, the rights of privacy and data protection”.

As the specific technical characteristics of spyware tools like  Pegasus make the control over their use very difficult, we have to rethink the entire existing system of safeguards established to protect our fundamental rights and freedoms, which are endangered by these tools.

With this document, the EDPS would Iike to contribute to the discussion on whether spyware tools Iike Pegasus should have any place in a democratic society. At the center of any such discussion, should not only be the use of the technology itself, but the importance we attribute, as a society, to the right to privacy as a core element of human dignity.

Read the complete paper: EDPS Preliminary Remarks on Spyware (PDF) – Mouseover to Scroll

Read the original report.

*Shared with permission.

Additional Reading

• [Annual Update] International Cyber Law in Practice: Interactive Toolkit
• Defining Cyber Discovery? A Definition and Framework

Source: ComplexDiscovery