Image: Tianyi Ma, Unsplash
The UN Convention on Cybercrime requires that all signatory states have legislation to enable the prevention, detection, investigation and prosecution of cybercrime offences.
Those offences includes, for example, illegal access to informations and communications systems; or the illegal interception of electronic data.
The EU is due to sign the treaty, which will apply to areas of law within its competences. Member states, if they are to sign it, will do so separately.
A number of organisations, including Statewatch, previously warned that “the proposed Convention’s use of broad or undefined concepts opens up the risk of widescale human rights violations against civil society.”
Cybercrime laws have often been used by states to target human rights defenders and other critics.
Rules of procedure
Article 57 of the Convention requires that signatory states agree on rules of procedure for a “Conference of the States Parties to the Convention”.
That Conference is supposed to “improve the capacity of and cooperation between States Parties to achieve the objectives set forth in this Convention and to promote and review its implementation.”
Comments from the EU and its member states on the draft rules of procedure (pdf), circulated in the Council of the EU on 3 September, call for the draft rules to be amended.
The introduction to the comments says the rules should “preserve and enhance the level of involvement and participation” of “multistakeholders”.
That includes “relevant non-government organizations, civil society organizations, academic institutions and the private sector.”
In July, three organisations and an individual involved in the negotiations on the Convention published an open letter on the draft rules.
They warned that the draft rules included “weak procedures for monitoring, oversight, accreditation and engagement by non-governmental actors.”
Documentation
- UN Convention against Cybercrime – Contribution of the EU and its Member States on the consolidated draft text of the rules of procedure (Council doc. 12366/25, LIMITE, 3 September 2025, pdf)
