Key Takeaways
- The EU’s Dual-Use Regulation (2021) aims to stop the export of surveillance tech that could enable rights abuses, but implementation is weak.
- Human Rights Watch found that EU member states have licensed exports of intrusion software and telecommunication interception systems to governments with documented records of repression, such as Azerbaijan, Rwanda, and others.
- The European Commission’s 2024 implementation guidelines obscure export details, undermining the regulation’s transparency goal and preventing effective scrutiny.
- The Commission cites commercial confidentiality as the reason for limited disclosure, yet this conflicts with its legal duty to make licensing data public.
- Under international human rights law, states must regulate, monitor, and enforce controls on surveillance exports to prevent facilitation of rights violations.
- The Commission should revise its guidelines to align with the Dual-Use Recast, enforce real‑time transparency, mandate meaningful due diligence by companies, and involve civil society in the upcoming 2026 evaluation.
Overview of the Human Rights Watch Report
Human Rights Watch released a 54‑page study titled “Looking the Other Way: EU Failure to Prevent Surveillance Exports to Rights Violators,” which evaluates how the EU’s Dual‑Use Regulation is functioning in practice. The report concludes that the EU is not preventing member states from exporting surveillance technology to governments that use such tools to crack down on activists, journalists, and other dissenting voices. Despite adopting one of the most progressive regimes to curb harmful tech sales, the EU’s current approach allows rights‑abusive regimes to acquire sophisticated surveillance equipment from European firms.
Background on the EU Dual‑Use Regulation
Adopted in 2021, the Dual‑Use Regulation (often called the “Dual‑Use Recast”) governs the export of items that can serve both civilian and military purposes, including commercial surveillance technology. Its core purpose is to block transfers where there is a significant risk that the technology will be used to violate international humanitarian or human rights law. The regulation requires EU member states to report each licensing decision to the European Commission, which must then make the information publicly available to enable oversight and accountability.
Methodology and Data Collection by Human Rights Watch
To assess compliance, Human Rights Watch filed freedom‑of‑information requests in all 27 EU member states, seeking details on licensing and exports of surveillance technology. Data were received from nearly half of the countries that submit information to the Commission. The organization combined these responses with the Commission’s public reports and additional transparency requests to analyze patterns of licensing. This approach revealed systemic gaps in how export data are gathered, reported, and made accessible to the public.
Flaws in the Commission’s Transparency Guidelines
In 2024 the European Commission issued implementation guidelines that reinterpret the Dual‑Use Recast’s transparency obligations. Rather than requiring detailed, item‑by‑item disclosure of what technology is shipped to which destination, the guidelines aggregate data in a way that obscures specific transactions. Human Rights Watch argues that this redesign defeats the regulation’s aim of enabling scrutiny, as policymakers, researchers, and affected communities cannot determine whether particular exports end up in the hands of rights‑violating governments.
Evidence of Problematic Exports
Despite the obscured reporting, the data obtained by Human Rights Watch show clear instances of concerning transfers. Examples include the export of intrusion software and telecommunication interception systems from Bulgaria to Azerbaijan in 2022, and the shipment of similar interception technology from Poland to Rwanda in 2023. Additional cases involve exports to other states known to deploy surveillance tools against journalists, activists, and marginalized groups, indicating that EU‑origin technology is contributing to repression abroad.
Commission’s Response and Justification
When questioned about the lack of detail, the European Commission stated that EU member states retain sole responsibility for licensing decisions on dual‑use exports. It defended its current data‑collection approach by claiming that, at the time the 2024 recommendation was drafted, only a limited number of companies were active in this market, and greater transparency could jeopardize commercial confidentiality or reveal company identities. This stance, however, conflicts with the regulation’s explicit mandate for public disclosure and overlooks the broader public interest in preventing rights abuses.
Legal Obligations and Recommendations for Reform
Both EU member states and surveillance‑based companies bear distinct responsibilities under international human rights law. States must not only adopt export controls but also actively implement and monitor them to ensure they prevent misuse. Companies must conduct credible human‑rights due diligence, assessing whether their products are likely to facilitate violations and taking steps to mitigate those risks. Human Rights Watch urges the Commission to issue new guidelines that closely follow the letter of the Dual‑Use Recast, mandate real‑time, granular transparency of exports, and require exporters to undertake meaningful due diligence before granting licenses.
Path Forward: Evaluation and Stakeholder Participation
The Dual‑Use Regulation obliges the Commission to commence a formal evaluation later in 2026. This review offers a critical opportunity to correct the current shortcomings. The Commission should use the evaluation to strengthen due‑diligence requirements, enforce robust transparency mechanisms, and ensure meaningful participation of all relevant stakeholders—including human‑rights NGOs, civil‑society groups, and affected communities. Only through such reforms can the EU fulfill its promise to keep its surveillance technology from enabling repression around the world.