The European Media Freedom Act (EMFA), introduced in September 2022 as a cornerstone of a renewed commitment to European Union (EU) democracy, has faced months of negotiations and controversy, culminating in a political deal reached during the final trilogue on 15 December 2023 amidst considerable political pressure. Regrettably, the agreed-upon version of the text falls short in providing adequate protection for journalists and their sources.

Despite its avowed goal of ensuring media independence, freedom, and pluralism under the banner of “Defense of Democracy”, the negotiated agreement lacks essential safeguards against dangerous surveillance measures targeting journalists in the EU, raising substantial concerns from a digital rights perspective. In the conclusive political negotiations, the provisions intended to shield journalists and sources from state interference, notably in Article 4 addressing the rights of media service providers, failed to meet their initial objectives. Furthermore, Article 17 and the “media exemption” raise specific concerns, potentially undermining the provisions of the Digital Services Act (DSA).

Legalising Spyware Use Amidst Ongoing Scandals

The EMFA represents, even if inadvertently, the EU’s first attempt to regulate the use of spyware. This came after years of scandals involving tools like Pegasus and Predator employed by EU governments (similarly to authoritarian governments worldwide, often turning to companies that had first tested their products on Palestinians under occupation). These spyware tools have been maliciously used against journalists, political dissidents and human rights defenders. Despite this, EU member states haveargued spyware as necessary for national security.

Spyware, inherently uncontrollable both technically and politically, infringes upon the fundamental right to privacy at an unacceptable level in democratic societies, a stance underscored by the European Data Protection Supervisor (EDPS) and other international entities time and again. EDRi and its members have consistently called for a complete ban on all spyware use against journalists and their sources, alongside the inclusion of more fundamental rights safeguards. Regrettably, these pleas seem to have fallen on deaf ears.

While the text includes safeguards already established in EU law, the final deal raises considerable concerns about the legalisation of spyware use at the EU level, introducing uncertainty in Member States where intrusive surveillance tools are currently prohibited by domestic laws or lack a legal basis for deployment. It thus sets a worrisome precedent and potentially compromises fundamental rights and protections across Member States. The text confirms the “respect” of Member States’ responsibilities, explicitly mentioning Article 4(2) TEU, which states that “national security remains the sole responsibility of each Member State.” The consequence is that the Council’s retention of the national security exemption enables EU governments to potentially deploy spyware against journalists under the guise of national security outside the protective framework of EU law.

Historic precedents of spyware use have demonstrated how EU Member States can easily circumvent legal limitations, deploying very intrusive surveillance methods without control or oversight. The final report from the European Parliament’s PEGA Committee illustrated how authorities have felt at ease abusing these intrusive tools on many occasions.

The use of spyware violates journalists’ due process rights and poses a tangible threat to freedom of expression and access to information. With the EMFA’s political deal, the EU missed a unique opportunity to address the potential chilling effect on civil society dynamics and the public’s ability to access accurate and reliable information. The deal thus risks legitimising state repression against investigative journalists and the entire media sector, casting a dark shadow over the EU’s ability to prevent surveillance abuses and maintain its global image as a safe haven for press.

Wide Discretion for Member States and Threats to Journalists’ Rights

Article 4, as it stands, also fails to meet the established legal standards found in the jurisprudence of European Courts. Over the years, safeguards related to the protection of journalistic sources have been meticulously developed in the jurisprudence of the European Court of Human Rights, alongside privacy requirements outlined in the case law of the Court of Justice of the European Union. According to the agreed-upon EMFA text, state authorities could potentially compel journalists to disclose their sources using unspecified means, subjecting them to the risk of criminalisation.

Fewer sources would be willing to jeopardise contact with a journalist if there’s a possibility that the government is eavesdropping on them. The expansive interpretation of an “overriding reason of public interest” poses a significant threat to journalists’ rights, exposing them to potential detention, office searches, and wiretapping without explicit accusations of serious criminal offences.

As a troubling indication of the Council’s stance on state interference, recent leaks reveal the determination of Member States such as France and Hungary to dilute the requirement for prior authorisation from a judicial authority. This endeavour was partly successful, as the Parliament dropped the condition that the judicial authority be independent and impartial. This means that public prosecutors with administrative ties to the executive in certain Member States could still qualify for such a crucial control mechanism.

Efforts to undermine the fundamental right to effective remedies were also influential. The revised text now exclusively references the EU’s Law Enforcement Directive concerning the right to be informed when subjected to surveillance. However, the Directive maintains serious legal ambiguity, leaving law enforcement authorities’ duty to notify individuals affected by surveillance operations open to interpretation. This grants Member States considerable discretion to curtail their rights, thus causing the EMFA to fall short of its promise to harmonise disparate national systems through a common protective framework at the EU level.

Similarly the Council succeeded in expanding the list of serious crimes justifying the deployment of spyware. The deal dramatically broadens the list originally proposed by the Commission, including arguably minor offences such as “counterfeiting and piracy of product”or “swindling” in proportion to the fundamental rights interference at stake. The scope also encompasses crimes carrying a custodial sentence of at least five years, as defined solely under national law. Once again, the substantial discretion given to Member States undermines the original purpose of the EMFA.

Equally concerning, the final text erodes safeguards introduced by the European Parliament, particularly the requirement that investigations justifying repressive measures must not be related to the professional activity of the journalist or their employer. This concern is heightened by past instances of politically motivated surveillance in several Member States.

The ‘Media Exemption’: Undermining the Digital Services Act

Moreover, the agreed-upon text of EMFA seeks to undermine the DSA, a text that underwent years of approval and in which digital rights organisations like EDRi and its allies successfully introduced critical guarantees concerning freedom of expression and the fight against disinformation by ensuring accountability and transparent content moderation systems for all online content. Notably, Article 17 introduces exemptions for content created by entities claiming to be independent and regulated media providers.

The text mandates Very Large Online Platforms (VLOPs) to afford special privileged treatment to such entities, placing them in a challenging position where they must choose between the potential risk of leaving harmful, possibly illegal content online or investing time and effort in protracted communications with media services during the process. This move has faced repeated criticism from EDRi’s member EFF, cautioning against a blanket exception from regulatory provisions that could jeopardise the media’s ability to deliver trustworthy information and act as a counter-power in our political arenas.

Conclusion: A Missed Opportunity That Should Not Become a Precedent

When the Parliament engaged in negotiations with the Council during the inter-institutional process, expectations for outcomes guaranteeing more rights protections were low, given the Council’s entrenched position and the tendency of opaque deliberative processes to result in weakened safeguarding provisions and accountability mechanisms. In its text, the Commission underscored the crucial ‘public watchdog’ role journalists play in democracies, a role unmistakably eroded by the final version of EMFA. Once again, the Council has demonstrated its willingness to disregard EU law by invoking the ‘national security’ carte blanche and blanket exception, too frequently misused for social and political control.

It is imperative that we prevent the EMFA political deal from establishing an all-encompassing precedent for state interferences and abuses in the future. The potential ripple effect on national legislation becomes doubly perilous when considering that several Member States have unmistakably indicated their desire to extend the reach of surveillance by disproportionately expanding the powers of their intelligence agencies and other law enforcement bodies in recent years.

Particularly concerning journalists, significant threats to basic rights and democratic principles arise when their devices’ communications are unlawfully compromised.

EMFA marks an initial attempt to regulate spyware use, and the final text’s failure to both ban and constrain its use is a stark and alarming reality. New legislation is essential within the EU to prohibit the development, trade, and utilisation of spyware by its member states. EDRi will persist in advocating for a complete ban on spyware to ensure that journalists, EU citizens, and other communities can thrive in a safe and secure digital environment.