The EU executive tells member countries national security isn’t a blank check to justify spyware use.

European Union countries can’t call on national security as a blank check to justify their use of spyware, the European Commission said in a document seen by POLITICO.

Governments that decide to use intrusive surveillance software, like NSO Group’s Pegasus "cannot exercise their responsibility in a way that undermines the effectiveness of EU law” on data protection and privacy, said the draft communication, written in response to a European Parliament committee report on spyware.

National security has been used as an excuse by some EU governments that have used spyware to collect information from phones and other devices belonging to lawyers, journalists and even opposition politicians.

In Spain, at least 65 Catalan separatist politicians have been targeted by spyware. In Greece, a scandal erupted when the government acknowledged it had wiretapped an opposition leader’s phone. There are also cases in Poland and Hungary of spyware being used against activists and journalists.