On 22 June 2026, Executive Vice-President Henna Virkkunen, on behalf of the European Commission, answered a parliamentary question from Greek MEP Lefteris Nikolaou-Alavanos (NI) concerning the trade and use of spyware, particularly the Predator software, and alleged cover-ups by the Greek government. The Commission firmly stated that any illegal access to citizens' data, including that of journalists, civil society representatives, and political opponents, is unacceptable, and that legal surveillance must be limited to specific circumstances such as crime prevention and prosecution, subject to strict safeguards.
The answer, which reiterates existing EU law rather than announcing new measures, references the data protection Law Enforcement Directive (Directive 2016/680) as applicable when authorities process personal data for law enforcement, and notes that national supervisory authorities have powers to investigate misuse. It also highlights the European Media Freedom Act, whose provisions against spyware use on journalists entered into application in August 2025. The Commission did not address the specific allegations of a cover-up by the Greek government or the role of Regulation (EU) 2021/821 on dual-use goods, which the MEP argued legalises spyware trade. The response thus offers no concrete new action but reaffirms the existing legal framework, leaving enforcement to national authorities. The answer signals that the Commission views the issue as a matter of national implementation rather than a gap in EU law, potentially disappointing critics who seek stronger EU-level oversight. Stakeholders impacted include journalists and civil society, who may see limited immediate protection; EU citizens concerned about privacy; spyware producers like Intellexa, who face no new restrictions; and national governments, which retain discretion under the current rules.