Cybersecurity Lock

On February 1, 2021, a new draft act on freedom of speech on social media platforms appeared on the Polish Ministry of Justice website.

Works on the draft act, originally announced by the ministry in December last year, gained momentum in mid-January amid Twitter and Facebook blocking Donald Trump’s accounts, which the Polish government viewed as censorship.

The Minister of Justice said that freedom of speech and debate is the cornerstone of democracy and censoring statements, especially online, where most political discussions and ideological disputes take place these days, infringes on those freedoms. Therefore, Poland should have regulations in place to prevent abuse on the part of internet tycoons, which are increasingly limiting this freedom under the auspices of protecting it.

The new law aims to protect the constitutional freedom of speech, as well as the individual personal interests that anonymous internet users may violate.

The draft act envisages the appointment of the so-called Freedom of Speech Council, which would safeguard the constitutional freedom of expression on social networking sites. The council would comprise law and new media experts and it would be appointed by the lower chamber of the Polish Parliament – the Sejm – for a six-year term of office, by a qualified (3/5) majority (the Senate, historically involved in similar processes, would not participate in the appointment).

The draft act also provides that if a website blocks an account or deletes a certain entry, even though its content does not violate/infringe upon Polish law, the user will be able to lodge a complaint with the service provider. The provider must confirm that the complaint has been received and will then have 48 hours to consider it. If the provider dismisses the complaint, the user will be able to appeal that decision to the Freedom of Speech Council, which will consider the appeal within seven days. The proceedings before the council would be conducted electronically, to expedite the process and minimize the costs. The council will proceed in closed sessions. It will not take evidence from witnesses, parties, expert opinions and visual inspections, and the evidentiary proceedings before the council will boil down to evidence submitted by the parties (the user and the provider, represented by its representative in the country) or to information already known to the council.

If the council deems the appeal justified, it may order the website to immediately restore the blocked content or account. Thereafter, having received the order, the provider will have no more than 24 hours to comply. Failure to comply with the council’s order may lead to an administrative fine of up to PLN50,000,000 (i.e., €11,000,000). Such high financial penalties may prevent social networking services administrators from removing content, even if it is clearly harmful, out of fear of disputes as to such content’s legality.

In addition, the provider will not be able to limit access to content that has already been scrutinized by the council, even if the circumstances should later change and the entry proves to be unlawful after all. The council’s decision will be final and the new body will be able to limit its statement of grounds solely to an indication of the facts that it deemed evident and to quoting the legal provisions that constituted the legal basis for the decision reached, which may, in fact, deprive the provider of the right to appeal to the administrative court.

The draft act also introduces the so-called “John Doe lawsuit.” An individual whose personal interest has been infringed on by an anonymous internet user will be able to file a lawsuit without having to provide the infringer’s personal details. Currently, in order to successfully sue in a civil court (e.g., a personal interest infringement suit), the claimant must provide the alleged infringer’s name and address. This is obviously very difficult, if not impossible, in the case of online defamation. The draft act provides that in order to successfully sue in a civil court, the claimant will only be required to indicate the URL address where the defamatory statements have been posted, the time and date of online publication, the name of the website where they have been posted and the defendant’s login. To date, individuals who have had their personal interest infringed on online had to report their defamation cases to the police as crimes, only to establish the infringer’s identity. This was highly ineffective and prevented claimants from pursuing their rights in civil courts.

Once the draft act is passed, it will dramatically impact online media in Poland. The disproportionately high financial penalties for blocking online content (up to €11,000,000) will most likely have social networking services administrators err on the side of caution before blocking any content at all (even if harmful and illegal). Paradoxically, the incidence of harmful and illegal online content will increase rather than drop.

It is yet to be seen whether the draft will actually be proceeded, or later adopted, especially given the fact that freedom of online expression is currently being regulated on the EU level.

The recently announced European Commission’s proposal of the Digital Services Act (DSA) already addresses online freedom of speech. It provides, in particular, that it will be impossible to block a user’s account without informing them of such decision and justifying it, as well as without giving them a chance to challenge such decision via various online procedures. The DSA , onceapproved, will be directly applicable in all member states, including Poland. Proceeding with the ministerial draft act, which duplicates many of the DSA provisions, seems counterproductive and redundant.

As at the date of this post, the draft legislation has not yet been posted on the governmental legislative center website.

As a reminder, two years ago, the Polish Ministry of Digital Affairs and Facebook signed an agreement on the appeal procedure against content blocked on the website. The parties took measures to establish a point of contact designated to submit notifications by users whose content, accounts or profiles were blocked/removed with the view to conduct additional review. See Można będzie odwołać się od decyzji Facebooka po zablokowaniu konta | CHIP.

The draft act, which was supposedly submitted with the Chancellery of the Prime Minister on January 22, 2021, to be entered in the register of legislative works of the Chancellery, is available on the Ministry of Justice website.

Simultaneously, the Polish government is working on another piece of legislation featuring a solution aimed at exerting control over online content and allowing the government to intervene in removing such content or block access to such websites.

First, the proposed amendment to the Act on National Cybersecurity System is aimed at strengthening Polish cybersecurity through, inter alia, excluding certain equipment and blocking access to certain IP addresses.

The contemplated legislation would empower the minister for IT implementation to issue a so-called “security order.” In case of a so-called “critical incident” (i.e., an incident resulting in significant damage to public safety or order, international interests, economic interests, activities of public institutions, civil rights and freedoms, or human life and health), the minister would be able to oblige particular entities within the National Cybersecurity System, as well as telecommunications operators, to undertake certain actions. These actions may include “introducing a network traffic rule to prohibit connections to certain IP addresses or URL names,” meaning that certain websites or addresses may simply become unavailable in Poland. This would seem like a typical measure to counteract cybersecurity threats, but there are two provisions that have sparked heated debate. First, the minister may issue the security order for a period of up to two years. Second, such security order is immediately enforceable, regardless of any appeals against the decision. The decision’s addressee may lodge an appeal with an administrative court, but given the timespan necessary to go through the court proceedings, the potential relief from the court could come very late. Finally, many commentators raise that denying access to certain parts of the internet may be excessive and disproportionate in comparison to the objective the Cybersecurity Act seeks to achieve. So far, telecommunications operators have been obliged to block access to websites used for unauthorized gambling, and now the minister will obtain an additional tool to block access to other websites or URL addresses if such ban may, in the minister’s assessment, help in counteracting critical cybersecurity incidents.

The last piece of legislation currently legislated is an amendment of the Act on Competition and Consumer Protection. The objective is to incorporate into the Polish legal framework Regulation (EU) 2017/2394 of the European Parliament and of the Council of December 12, 2017, on cooperation between national authorities responsible for the enforcement of consumer protection laws and repealing Regulation (EC) No. 2006/2004, i.e., the so-called CPC regulation (CPC), providing for enhanced competences of consumer protection authorities with regard to investigating and enforcing the provisions pertaining to breaches of such laws. Some of the competences under CPC will be allocated to the president of the Office of Competition and Consumer Protection (UOKiK) acting individually, while the remaining measures will be taken in cooperation with other authorities.

Among its new competences, UOKiK will now be able to block entrepreneurs’ websites, without commencing any procedures beforehand. If concerned about competition and consumer protection, UOKiK may request that an entrepreneur warn consumers visiting its website, delete certain content or restrict access to it, or even take the internet domain down entirely. Should an entrepreneur refuse, UOKiK will be able to – by way of an administrative decision – oblige it to take certain measures. While such a decision may be appealed in court, an entrepreneur may not operate its website until a ruling has been issued. This new law is expected to come into force in Q1 2021.