11. The Assembly considers that the national investigative authorities and courts of the member Statesaccused of spyware abuses must fully investigate and determine whether the use of Pegasus and similarspyware was lawful under domestic law and compliant with the Convention and other international standards.This implies assessing in each individual case whether the interference pursued a legitimate aim under Article8.2 of the Convention and whether it was strictly necessary in a democratic society and proportionate to thataim. It also means ensuring that all victims of spyware-related abuses have access to effective remedies andredress. In this context, the Assembly urges:

11.1. Poland, to:

11.1.1. inform the Assembly and the European Commission for Democracy through Law (Venice Commission) about the use of Pegasus and similar spyware, within three months;

11.1.2. conduct effective, independent and prompt investigations on all confirmed and alleged cases of abuse of spyware and provide sufficient redress to targeted victims in cases of unlawful surveillance;

11.1.3. refrain from using blanket secrecy rules to deny oversight mechanisms’ and targeted persons’ access to information on the use of spyware;

11.1.4. apply adequate sanctions, either criminal or administrative, in cases of abuse;

11.1.5. comply with the opinion of the Venice Commission on the 2016 Police Act;

11.2. Hungary, to:

11.2.1. inform the Assembly and the Venice Commission about the use of Pegasus and similar spyware, within three months;

11.2.2. conduct effective, independent and prompt investigations on all confirmed and alleged cases of abuse of spyware and provide sufficient redress to targeted victims in cases of unlawful surveillance;

11.2.3. refrain from using blanket secrecy rules to deny oversight mechanisms’ and targeted persons’ access to information on the use of spyware;

11.2.4. apply adequate sanctions, either criminal or administrative, in cases of abuse;

11.2.5. implement without delay the judgments of Szabó and Vissy and Hüttl, as required by the Committee of Ministers in the exercise of its powers under Article 46.2 of the Convention;

11.3. Greece, to:

11.3.1. inform the Assembly and the Venice Commission about the use of Predator and similar spyware, within three months;

11.3.2. conduct effective, independent and prompt investigations on all confirmed and alleged cases of abuse of spyware and provide sufficient redress to targeted victims in cases of unlawful surveillance;

11.3.3. refrain from using blanket secrecy rules to deny oversight mechanisms’ and targeted persons’ access to information on the use of spyware;

11.3.4. apply adequate sanctions, either criminal or administrative, in cases of abuse;

11.4. Spain, to:

11.4.1. inform the Assembly and the Venice Commission about the use of Pegasus, Candiru and similar spyware, within three months;

11.4.2. conduct effective, independent and prompt investigations on all confirmed and alleged cases of abuse of spyware and provide sufficient redress to targeted victims in cases of unlawful surveillance;

11.4.3. refrain from using blanket secrecy rules to deny oversight mechanisms’ and targeted persons’ access to information on the use of spyware;

11.4.4. apply adequate sanctions, either criminal or administrative, in cases of abuse;

11.5. Azerbaijan, to:

11.5.1. inform the Assembly and the Venice Commission about the use of Pegasus and similar spyware, within three months;

II SÉRIE-D — NÚMERO 18 ____________________________________________________________________________________________________________

126