European Commission wears ‘velvet gloves’ when dealing with spyware used on citizens, says chief of inquiry on hacking software, including Pegasus