Answer given by Executive Vice-President Dombrovskis on behalf of the European Commission
The Commission has contacted the competent authority in Cyprus regarding the alleged exports of ‘NSO Pegasus spyware’, who confirmed that they have not issued any export licenses under Regulation (EC) No 428/2009, nor received any application from this company. The Cypriot authorities also report that, according to their investigation, NSO is not registered in Cyprus.
To date, the Commission has not been seized with evidence that European nationals that are activists or journalists have fallen victim to this spyware.
In 2016, the Commission presented a legislative proposal to enhance export controls, especially with respect to exports of cyber-surveillance technologies that may be misused for human rights violations. The Commission welcomes that the co-legislators have agreed at a trilogue on 9 November 2020 on a new set of rules that will make these controls more effective. It is expected that the new rules will become effective in the second half of 2021.
-  https://trade.ec.europa.eu/doclib/docs/2016/september/tradoc_154976.pdf