“In a democracy, putting people under surveillance should be an exception and there should be rules,” Ms. in ‘t Veld said.

The report follows a proposal in September from the European Commission, the EU’s executive body, which would ban the use of surveillance software to spy on journalists. Speaking to reporters on Tuesday, Ms. in ‘t Veld called for even broader curbs to how governments can use spyware. 

A European country should be allowed to sell, acquire and use spyware only if it fulfills several criteria, such as disclosing a list of crimes for which it will deploy the spyware and if it has bought a license to use it, her report said. “We need to strengthen supranational enforcement,” she said.

On Monday, Greece’s government said it would ban the sale of spyware after a newspaper reported that more than 30 people, including politicians and journalists, had been under state surveillance. 

Reports about the software in Greek media have caused uproar in recent months after an opposition politician found that his phone had been targeted with a spyware variant known as Predator, which is made by the company Cytrox, according to Citizen Lab, a research group at the University of Toronto. 

The European Parliament investigative committee will continue its work for several months and vote next year on a final version of the report, which isn’t legally binding. Ms. in ‘t Veld said the use of spyware violates several European laws, including the General Data Protection Regulation, but national governments aren’t enforcing the rules. European authorities have condemned the abuse of spyware but argue that surveillance is a matter for the security authorities of individual member countries.

The European Court of Human Rights, which hears cases alleging rights violations by member states, recently highlighted national governments’ role in regulating surveillance. The court ruled in September that Hungarian legislation lacked sufficient safeguards in a case involving Benedek Jávor, a former member of the European Parliament who alleged his phone was under surveillance while he was in office. 

During a phone call in 2015 with a lawyer from a civil liberties group, Mr. Jávor said the call ended suddenly. When the lawyer called Mr. Jávor’s other cellphone, he heard a recording from their previous call. “There should be strong pressure from the European institutions on the Hungarian government to change the legislation,” Mr. Jávor said in an interview.

Spyware makers including Israel-based NSO Group have been controversial since details emerged more than a year ago about how some governments use the tools. Ms. in ‘t Veld’s report includes a section on NSO Group and other firms that sell similar software, some of which are headquartered in the EU.

NSO Group didn’t respond to a request for comment. In a European Parliament hearing this summer, a representative from the company said that it has sold the software to at least five EU member countries.

Last year, the Biden administration placed NSO Group on an export prohibition list, preventing it from obtaining certain technology from the U.S. and making it more difficult for the company to seek international customers. The move followed investigations from a consortium of news outlets into NSO Group’s sale of Pegasus to dozens of government and law-enforcement customers around the world for spying on journalists, politicians and human rights activists. 

Researchers have pointed to governments outside Europe that use Pegasus to extract information from phones. Citizen Lab said in January that around 35 journalists and activists in El Salvador were targeted with the spyware, The Wall Street Journal reported at the time. Israeli police have said that they use various types of spyware including one developed by NSO Group.

Privacy advocates have called for a permanent ban on software such as Pegasus. The spyware goes beyond surveillance because it allows for a user to take control of a target’s phone, giving them access to make changes to their data, said Fanny Hidvégi, Europe policy and advocacy director at the nonprofit Access Now. “There’s no safeguard that can make that use legitimate,” she said.

Write to Catherine Stupp at catherine.stupp@wsj.com