A Human Rights Watch report found Bulgaria and Poland among E.U. states that exported surveillance tools to governments with abuse records