The admission, recounted to AFP by sources at the meeting, confirmed earlier reports in German media outlets Zeit, Sueddeutsche, NDR and WDR.
Pegasus, which is able to switch on a phone’s camera or microphone and harvest its data, came under global scrutiny after a list of about 50,000 potential surveillance targets — including journalists, activists and politicians — was leaked in July.
French President Emmanuel Macron changed his phone after his number appeared on a list of potential targets.
The German parliamentary sources said the BKA, which falls under the interior ministry, used the Pegasus software “in a small number of cases”.
It remains unclear whether German intelligence agencies also used the software.
Germany’s strict privacy laws only allow for data harvesting under very specific conditions, which led the BKA to buy a version of the software in which some spy functions were switched off, the committee heard.
It is not known what, if any, safeguards were in place to ensure those options remained unused.
Greens’ lawmaker Konstantin von Notz called the Pegasus acquisition “a nightmare for the rule of law” and demanded “a full explanation” from Chancellor Angela Merkel’s government.
Amnesty International called for “urgent rules on public procurement that require state agencies to also consider companies’ human rights records when making purchases”.
“We want to know if journalists were spied on without their knowledge and whether their sources are still safe,” added Frank Ueberall, chairman of the German Federation of Journalists (DJV).
Pegasus’s list of alleged targets includes at least 600 politicians, 180 journalists, 85 human rights activists and 65 business leaders.
NSO has insisted that its software was intended for use only in fighting terrorism and other crimes.