The European Union has positioned itself as a global leader in digital rights, most notably through the General Data Protection Regulation (GDPR). Yet its more recent proposal to mandate the scanning of private communications, ostensibly to combat child sexual abuse material (CSAM) and other harmful content, marks a stark departure from its tradition of safeguarding personal privacy. While the protection of vulnerable groups is an unquestionable imperative, the proposal introduces mechanisms that threaten fundamental liberties, erode trust in digital services, and create long-term risks for European society. This article argues that the proposal undermines core principles of liberty, risks legitimising mass surveillance, and could lead to further restrictions on freedom under the guise of security and protection. Furthermore, it considers the wider implications for businesses, civil society organisations, and protest groups.

Liberty and Privacy under Threat

The erosion of private communication

Private messaging, whether via encrypted applications, email, or direct chat, has long been regarded as a cornerstone of individual freedom. The EU's proposal effectively obliges providers to introduce automated surveillance tools capable of intercepting and analysing private messages. Such a move redefines private communication as conditional, subject to inspection by technology and, indirectly, by the state.

This constitutes a profound shift in the balance between state power and individual liberty. Historically, liberal democracies have recognised that freedom of communication is a prerequisite for other freedoms, such as freedom of expression, freedom of assembly, and freedom of conscience. By mandating scanning technologies, the EU risks normalising the notion that privacy must always yield to security.

Slippery slope to broader surveillance

Once the technological and legal infrastructure for message scanning is established, it becomes susceptible to expansion. Although the proposal is framed around preventing child abuse material, there is little to prevent future governments from extending its scope to include terrorism, extremism, misinformation, or even political dissent. Such mission creep has been documented in multiple contexts; for instance, surveillance powers introduced to combat terrorism have later been used against environmental activists or protest movements.

The gradual erosion of privacy reflects what legal scholars refer to as the "ratchet effect", a dynamic whereby powers initially introduced as temporary or exceptional measures, often justified by extraordinary circumstances such as national security threats or public health emergencies, become entrenched in the legal framework. Rather than being withdrawn once the immediate crisis has passed, these powers are normalised, institutionalised, and frequently repurposed for broader forms of state control, extending far beyond their original scope. In this way, each expansion of authority creates a new baseline from which further intrusions into individual freedoms may be justified, leading to a cumulative and often irreversible restriction on privacy and civil liberties.

Implications for Freedom of Expression

Chilling effects

The knowledge or suspicion that private communications may be subject to monitoring creates a chilling effect. Individuals are less likely to engage in open, honest conversation if they fear surveillance. These risks undermining journalism, political organising, and the work of human rights defenders, who often rely on confidentiality to protect sources and participants.

Impact on protest groups and NGOs

Civil society organisations, including NGOs and protest groups, often rely on secure digital communication to coordinate campaigns, mobilise supporters, and protect vulnerable participants. For example, environmental campaigners or pro-democracy activists may already face surveillance pressures from hostile governments or corporate actors. The introduction of EU-mandated scanning technologies could expose their communications to interception, weaken encryption standards, and ultimately place activists at greater risk of harassment or repression.

In this way, the proposal not only affects private liberty but also diminishes the vibrancy of democratic participation.

Risks to business and innovation

Burden on digital service providers

For technology companies, especially those offering end-to-end encrypted services, the proposal poses significant technical and legal dilemmas. Either they must break encryption to comply, thereby undermining their product's security, or risk penalties for non-compliance. Smaller businesses and start-ups may lack the resources to develop or integrate complex scanning technologies, creating a competitive disadvantage compared with large multinational firms that can afford compliance.

This undermines innovation in Europe's digital economy, discouraging new entrants and entrenching the dominance of already-powerful players.

Loss of consumer trust

If consumers come to believe that their messages are no longer truly private, trust in European digital services will inevitably decline. Users may increasingly turn to non-EU providers, or even to underground and unregulated technologies, in search of genuine confidentiality and security. Such a shift would not only fragment the digital marketplace but also undermine efforts to build a coherent European digital sphere. This loss of confidence would directly and disproportionately impact European businesses, many of which rely heavily on the EU's reputation for stringent data protection rules and high privacy standards as a key competitive advantage. In an interconnected and highly globalised economy, weakened trust risks generating not only reputational harm but also significant and measurable economic losses, ranging from reduced consumer uptake to diminished international competitiveness.

Wider social consequences

Normalisation of state oversight

Beyond the technical and business implications, the proposal risks fostering a cultural acceptance of surveillance as a normal feature of life. Citizens may come to regard privacy not as a right but as a privilege that can be suspended in the name of protection. This psychological shift undermines democratic resilience, making societies more vulnerable to authoritarian drift.

Disproportionate targeting

Experience shows that surveillance regimes often disproportionately target marginalised communities, including migrants, minority groups, and dissidents. By institutionalising message scanning, the EU inadvertently risks deepening social inequalities, as vulnerable populations are more likely to face intrusive monitoring and punitive outcomes.

Counterproductive outcomes

Ironically, the proposal may not achieve its stated aims. Determined offenders are likely to migrate to platforms outside the EU's jurisdiction or develop bespoke encrypted channels that evade detection. Meanwhile, law-abiding citizens will bear the brunt of surveillance, while law enforcement agencies become flooded with false positives generated by automated scanning systems. This diverts resources from genuine investigations and creates inefficiencies in combating the very crimes the proposal seeks to address.

Conclusion

The EU's proposal to mandate scanning of private messages represents a profound threat to liberty and freedom in Europe. While framed as a measure of protection, it risks creating a surveillance infrastructure that erodes privacy, undermines democratic participation, and weakens trust in digital technologies. Businesses face significant compliance burdens and reputational risks, while NGOs and protest groups face heightened vulnerability to repression.

History shows that once liberties are curtailed in the name of security, they are rarely fully restored. The EU, in pursuing this proposal, risks sacrificing its moral and legal leadership in digital rights. If privacy is compromised, Europe will not be safer, but rather less free, less innovative, and less democratic. The protection of children and vulnerable groups is essential, but it must not be used as a pretext for dismantling the very liberties that define European democracy.

Professor David Zammit serves as both a lecturer and the Rector of Pro Deo International University in Italy. He has been actively engaged in the field of education for the past 35 years. Throughout his career, he has delivered lectures in various countries and has participated as a speaker at numerous symposia.