Source: European Parliament
The Commission strongly condemns any illegal access or any form of unlawful interception of users’ communications. EU law on data protection and privacy offers comprehensive protection to the confidentiality of communications and users’ personal data and terminal equipment.
Without prejudice to the Commission’s role as guardian of the Treaties, the monitoring and enforcement of the EU laws lies primarily with the competent national authorities and courts.
Moreover, EU Member States are required under Directive 2013/40/EU[1] on attacks against information systems to ensure that cyberattacks, such as illegal system interference and illegal interception, are punishable as criminal offences. The responsibility for the investigation and prosecution of such offences falls under the responsibility of competent national authorities.
The 2024 Rule of Law Report[2], which was published on 24 July 2024, follows up on developments concerning the alleged illegal use of spyware in the context of the functioning of national checks and balances in response to such allegations. The Commission continues to monitor developments in this area in the context of the 2025 Rule of Law Report.