cyber-security 18 January 2018

EU Parliament toughens human rights provisions of recast dual-use legislation

In the EU Parliament (‘EP’) on 17 January, MEPs made amendments to the recast EU regime on dual-use goods, emphasising that potential human rights considerations should be a key factor in deciding whether to grant export licences for goods and technology.

One amended provision holds: ‘Certain cyber-surveillance items have emerged as a new category of dual-use items that have been used to directly interfere with human rights, including the right to privacy, the right to data protection, freedom of expression and freedom of assembly and association, by monitoring or exfiltrating data without obtaining a specific, informed and unambiguous authorization of the owner of the data and/or by incapacitating or damaging the targeted system.’

The provision adds: ‘Controls should be based on clearly defined criteria. These measures should not go beyond what is necessary and proportionate. They should, in particular, not prevent the export of information and communication technology used for legitimate purposes, including law enforcement and network and internet security research for the purposes of authorised testing or the protection of information security systems. The Commission, in close consultations with the Member States and stakeholders, should make available guidelines to support the practical applications of those controls upon entry into force of this Regulation.’

In response to EP proposals on the recast regime, the trade association DigitalEurope says that it ‘welcomes the EP’s efforts to bring more legal clarity in certain areas, such as the definition of cyber surveillance technology and the exception for security research [and considers] the differentiation between traditional dual-use items and cyber surveillance technology crucial to ensure clarity and security in daily businesses operations,’ but, it adds, ‘DigitalEurope strongly recalls that unilateral regimes harm the global competitiveness of European industry’ – an observation that echoes fears amongst some in the compliance community of potential divergence away from the Wassenaar Arrangement control lists, largely regarded as the bedrock of global export controls.