From 4 November to 12 November, the European Parliament will hold hearings to confirm the incoming European Commissioners. As part of this process, nominees have submitted written responses outlining their visions, priorities, and approaches to the portfolios they are set to manage. These answers provide valuable insights into how the new Commission might address some of the most pressing issues facing the European Union today.
Our analysis focuses on our three programmes: Security and Surveillance, Online Expression and Civic Space, and Equity and Data. While the written responses reflect promising commitments in some areas, there are still questions that the Parliament should raise during the hearings to ensure that the final agenda aligns with the EU’s values of privacy, democracy and fundamental rights.
Security and Surveillance
Commissioner-designate Michael McGrath, who is slated to take on the portfolio for Democracy, Justice, and Rule of Law, addressed concerns about the use of intrusive surveillance tools, such as spyware. He emphasised the role of the European Media Freedom Act (EMFA) in regulating this issue, highlighting that it includes a general prohibition on intrusive surveillance software in devices used by media service providers, as well as journalists. According to McGrath, the Act allows narrowly defined exceptions, which are subject to strict procedural conditions. However, European civil society and the European Data Protection Supervisor have been very critical of the text, warning that the safeguards introduced are insufficient to protect journalists against spyware surveillance.
While McGrath’s commitment to carefully monitor the application of these provisions is welcome, his responses raise questions about the Commission’s response to the PEGA Committee’s recommendations. Specifically, McGrath indicated that a non-legislative proposal on the use of spyware by national authorities would be developed in consultation with Member States, with a focus on data protection. However, there may be concerns that consulting Member States on this issue could allow for undue influence over the Commission, potentially resulting in lax standards that do not sufficiently address spyware risks. This matter should be clarified during the hearings.
Henna Virkkunen, expected to assume the role of Executive Vice President for Tech Sovereignty, Security, and Democracy, also addressed related issues in her written responses, from a cybersecurity standpoint. She outlined a comprehensive agenda to enhance cybersecurity across Europe, with a particular focus on the implementation and enforcement of existing regulations, such as the NIS2 Directive for critical entities and the Cyber Resilience Act (CRA). Virkkunen described the CRA as a “global game changer,” which aims to significantly reduce the vulnerabilities of connected products — vulnerabilities that could be exploited by malicious actors for purposes ranging from espionage to pre-positioning for disruptive attacks.
Virkkunen’s approach could signal a promising commitment to strengthening oversight of spyware use, given the severe threat these tools pose to EU cybersecurity and critical infrastructure. However, the extent to which her vision may include specific safeguards and guardrails for spyware remains to be clarified. Effective cybersecurity measures should be accompanied by strong regulations on surveillance technologies to protect individuals and institutions. Another point that should be clarified during the hearings is how Virkkunen plans to integrate action against spyware within her broader cybersecurity strategy, and whether she will take concrete steps to ensure strong safeguards against surveillance abuse.
Commissioner-designate Magnus Brunner, candidate for the portfolio for Internal Affairs and Migration, stated his position regarding access to data for law enforcement and the judiciary in his written answers. CDT Europe welcomes Brunner’s recognition of the need for a balanced approach that ensures security while protecting fundamental rights and maintaining strong cybersecurity protections to safeguard citizens and societies against evolving threats. Specifically, he recognises the importance of encryption and the need to avoid the introduction of new vulnerabilities that could be exploited by malicious actors.
However, some discrepancies are evident between his stance on encryption and his position on the ongoing negotiations regarding the Regulation laying down rules to prevent and combat child sexual abuse (CSAR). While he supports a swift resolution of the CSAR proposal, he is silent on the risks that the proposed scanning obligations pose to fundamental rights and the very cybersecurity and online privacy standards he advocates. The scanning technologies under consideration by the Council, such as client-side scanning and upload moderation, undermine encryption and introduce vulnerabilities that malicious actors might exploit — contradicting his earlier emphasis on protecting encryption and cybersecurity. A point to be clarified in the hearings is how Brunner intends to address these potential contradictions while upholding privacy and cybersecurity standards.
Equity and Data
Virkkunen’s cybersecurity agenda is closely linked to her broader vision for digital sovereignty, which includes strengthening Europe’s technological base while balancing security, privacy, and innovation. As part of her endorsement of a “paradigm shift” in favour of bolstering EU competitiveness and her vision for the EU to become “the AI continent”, Virkkunen calls for “lowering the threshold” for European businesses to adopt AI and “decreasing [their] compliance burden”. Despite this, Virkkunen’s answers remain regulation-neutral, leaving room for “innovation-friendly” legislation to be proposed when “necessary”. One such example is the Cloud and AI Development Act, which Virkkunen outlines as an instrument that will serve to attract investment in computing infrastructure and data storage, centering cloud computing and infrastructure as a key element. The Commissioner-designate also hints at potential copyright law reform, noting that she would “consider” the need to improve the existing EU copyright framework in light of AI-generated content. Further clarity is needed on the scope of these legislative proposals and their compatibility or integration with existing laws protecting fundamental rights. In particular, the AI Factories Act announced in the questions and answers —merely referred to as an “initiative” in the mission letter — warrants additional information.
Virkkunen notably fills key gaps left by the mission letter, underscoring the AI Act’s timely and predictable implementation as a key priority, and committing to uphold fundamental rights to the highest standards in enforcing legislation. Virkkunen further notes that developing technologies that empower human capabilities and deliver on European values can be a “competitive advantage” for made in EU products and services, highlighting the need to invest in safe, trustworthy and human-centric technologies that reflect these values, safeguard the European social model, and the safety of EU citizens. These commitments are welcome, and indeed much-needed at a time where unfettered innovation is hailed as an absolute good, without sufficient consideration of the impacts on individuals and communities.
These guarantees must stand strong when faced with the already significant pressure to lower barriers and thresholds. Some of the compromises the Commissioner-designate already ventures in her answers may not be compatible with fundamental rights: for example, protecting the right to privacy and keeping high standards of data protection — which Virkkunen endorses — may not be consistent with her plans for the EU’s data protection framework to be responsive to commercial and law enforcement needs. Virkkunen’s stance reflects a desire to support industry and foster innovation, but it also raises concerns about how fundamental rights will be upheld in practice, a point that should be clarified during the upcoming hearings.
Commissioner-designate Michael McGrath similarly tackles AI in his answers, noting several actions are needed for the full application of the AI Act in the justice area, including targeted guidance on how different tools fall within risk categories of AI Act and targeted funding to support the effective use of AI tools by judicial authorities. McGrath also commits to revisit the AI Liability Directive, analysing the current divergences of opinion between the co-legislators. Further information is needed regarding how the Commissioner-designate will ensure that consumers rights are robustly protected at a time when the College is calling for further use of AI systems.
Online Expression and Civic Space
On the platform regulation front, Henna Virkkunen praises the enforcement of the Digital Services Act (DSA), citing the ongoing investigations of the European Commission against Very Large Online Platforms and Search Engines. In the same line, she vows to take “decisive action” in the face of emerging dangers in the online environment “not shy[ing] away from taking forceful measures”, which is a welcome commitment. At the same time, she also noted that — if confirmed — she would ensure that the Commission develops into a regulatory authority that listens carefully and acts “in line with our rules and with full respect of due process rights”, which CDT has previously emphasised, while affirming her commitment to transparency for all stakeholders.
For civil society, it is crucial that the maximum standard for transparency continues to be applied, not only with regards to the redactions of Risk Assessment and Audit Reports and the functioning of the Board of Digital Services, but also in the development of secondary legislation, which must include a variety of stakeholders. In mentioning potential immediate dangers to citizens, Virkkunen also commits to cooperation with civil society alongside researchers and whistle-blowers, although it is not specified what form such cooperation should take. For civil society to effectively support enforcement through monitoring and evidence gathering, a “systematic dialogue” with the Commission is necessary – akin to what is promised for the Parliament’s Working Group on the implementation of the DSA. This should be clarified during the hearings.
In continuing the DSA’s enforcement, Virkkunen outlines four priority areas:
1) Online Protection of Minors;
2) E-commerce & non-compliant goods on online marketplaces;
3) Illegal content online;
4) Information integrity and election protection.
These areas intersect in several ways with forthcoming legislative proposals such as the Digital Fairness Act, which will be spearheaded by DG JUST, with Michael McGrath at the helm. McGrath, like Virkkunen, expresses his commitment to develop the “missing piece of the puzzle in the EU’s digital rulebook” in a way that complements the DSA in areas like tackling dark patterns, addictive design and online profiling, while adding supplementary obligations for commercial actors that are not online platforms and bolstering the protection of vulnerable consumers, like children. The online protection of minors is high on the agenda of both Directorate Generals, with explicit mention of the forthcoming Guidelines under Art. 28.
All this, it is emphasised, must be done while ensuring that no unnecessary overlaps with existing legislation are created and without placing an undue burden on companies, in particular start-ups and SMEs. Indeed, the principle of regulatory parsimony is echoed throughout the answers of both Commissioner-designates, with Virkkunen envisaging a potential simplification of the DSA when the time for reviews comes in November of 2025.
Finally, the European Democracy Shield — mentioned by Virkkunen and McGrath alike — is not sufficiently clarified, following the mission letters. For Virkkunen, this will primarily intersect with her stated priority of using the DSA as a tool to protect online information integrity in the context of elections. For McGrath, as Commissioner-designate for Democracy, Justice, and Rule of Law, it is at the forefront of his agenda and is framed not only in terms of foreign interference but also — crucially — domestic threats, such as the “erosion of democratic institutions”, though it remains unclear what that will mean in practice and should be elucidated during the hearings.