11.5.2. conduct effective, independent and prompt investigations on all confirmed and alleged cases of abuse of spyware and provide sufficient redress to targeted victims in cases of unlawful surveillance;

11.5.3. refrain from using blanket secrecy rules to deny access to information on the use of spyware to oversight mechanisms and targeted persons;

11.5.4. apply adequate sanctions, either criminal or administrative, in cases of abuse.

12. The Assembly considers that the Polish parliamentary election of 2019 was not fair as Pegasus wasused against political opponents during the electoral campaign.

13. The Assembly calls on member States which seem to have acquired or used Pegasus, includingGermany, Belgium, Luxembourg and the Netherlands, to clarify the framework of its use and applicableoversight mechanisms. It invites them to send this information, as well as any statistics on the use of Pegasus,to the Assembly and the Venice Commission within three months.

14. In order to prevent future abuses of spyware and human rights violations in Europe and beyond, theAssembly calls on all member States to:

14.1. ensure that their national laws on secret surveillance are in full conformity with the requirements of the European Court of Human Rights and the Venice Commission, with regard to quality of the law, authorisation procedures, supervision and oversight mechanisms, notification mechanisms and remedies, and review them if necessary;

14.2. ensure that the implementation of their legislative framework is effectively in line with the case-law of the European Court of Human Rights on targeted surveillance, with respect to legality, legitimacy, necessity and proportionality of any surveillance measure;

14.3. pending the assessment of their legislative framework and practice by the Venice Commission, refrain from using tools like Pegasus, Candiru, Predator or similar spyware;

14.4. in the mid-term, regulate specifically the acquisition and use of spyware by law enforcement and intelligence agencies, limiting the use of Pegasus-type spyware to exceptional situations as a measure of last resort, to prevent or investigate a specific act amounting to a genuine and serious threat to national security or a specific and precisely defined serious crime, and only targeting the person suspected of committing or planning to commit those acts. States should also establish oversight mechanisms, including parliamentary oversight, on the acquisition and use of spyware technologies, and incorporate an obligation to take into account proportionality considerations before acquiring and using new spyware;

14.5. criminalise the sale to and use of spyware by non-State actors;

14.6. ratify, if they have not yet done so, the Protocol amending the Convention for the protection of individuals with regard to the automatic processing of personal data (CETS No. 223) known as “Convention 108+”, which will apply to the processing of data for national security purposes, and already start implementing its standards in national law;

14.7. ratify, if they have not yet done so, the Convention on Cybercrime (ETS No. 185, “Budapest Convention”) and its Additional Protocols;

14.8. refrain from granting export licenses in respect of spyware technologies to countries where there is a substantial risk that those technologies could be used for internal or transnational repression and/or to commit human rights violations and revoke those granted in such cases;

14.9. join the Wassenaar Arrangement if they have not yet done so, and for States already participating in this arrangement, develop a human rights-based framework for the transfer of spyware technologies, according to which export licenses would require a human rights impact assessment of the recipient State and the companies’ compliance with the United Nations Guiding Principles on Business and Human Rights;

14.10. require that all spyware companies domiciled or conducting substantial activities within their jurisdiction apply human rights due diligence throughout their operations or in respect of such activities, in line with the CM/Rec(2016)3 of Committee of Ministers, and implement standards restricting public procurement contracts to only those companies which demonstrate that they apply human rights due diligence.

27 DE FEVEREIRO DE 2024 ____________________________________________________________________________________________________________

127