Although the law outlines protections such as prohibiting spyware or coercion to expose sources, those assurances are undercut by built-in loopholes.

Governments can bypass them if their actions are allowed under national or EU law and deemed proportionate to a vaguely defined “general interest.”