Archive for: legal regulations on computer networks

Database protection, case C-46/02

February 7th, 2011, Tomasz Rychlicki

The Court of Justice of the EU in its judgment of 9 November 2004 Case C-46/02 Fixtures Marketing Ltd v Oy Veikkaus Ab, held that the expression “investment in … the obtaining … of the contents” of a database in Article 7(1) of Directive 96/9/EC of the European Parliament and of the Council of 11 March 1996 on the legal protection of databases must be understood to refer to the resources used to seek out existing independent materials and collect them in the database. It does not cover the resources used for the creation of materials which make up the contents of a database. In the context of drawing up a fixture list for the purpose of organizing football league fixtures, therefore, it does not cover the resources used to establish the dates, times and the team pairings for the various matches in the league.

Computer crime, case II K 127/10

October 21st, 2010, Tomasz Rychlicki

A young man was charged with the removal of computer data in the form of virtual objects belonging to a specific game avatar. He acted to the detriment of another person, without authorization, with an Internet account in the Massively Multiplayer Online Role-Playing Game – Metin2. According to the indictment he obtained access (login, password) to someone else’s account using a keylogger software. The charges were based on the provisions of Article 287 § 1 of the Criminal Code – CRC – (in Polish: Kodeks Karny) of 6 June 1997, published in Journal of Laws (Dziennik Ustaw) No 88, item 553, with subsequent amendments.

Article 287. § 1. Whoever, in order to gain material benefits, affects automatic processing or transmitting information, or changes or deletes record or introduces a new record on an electronic information carrier, without being authorised to do so,
shall be subject to the penalty of deprivation of liberty for a term of between 3 months and 5 years.
§ 2. In the event that the act is of a lesser significance, the perpetrator shall be subject to a fine, the penalty of restriction of liberty or the penalty of deprivation of liberty for up to one year.
§ 3. If the fraud has been committed to the detriment of a next of kin, the prosecution shall occur on a motion of the injured person.

The Regional Court in Sławno in its judgment of 19 August 2010, case file II K 127/10 found him guilty of committing the offense, and sentenced to 1 year of imprisonment, suspended for a three-year period of probation. The court also ordered him to pay a fine up to 20 daily rates (10 PLN for a rate, a total of 200 PLN) and placed under supervision by a probation guardian.

Computer crime, case XII K 32/10

October 20th, 2010, Tomasz Rychlicki

A locally practicing lawyer (advocate) from Kielce used the nickname “bondd007” and posted on an online forum, among others such comments that the Director of the Tax Office in Kielce “probably likes” when the manager of one of the departments “puts an ice cream” – the expression in Polish slang that means oral sex.

The Regional Court in Kielce in its judgment of March 2010 case file XII K 32/10, found the lawyer guilty of defamation. The Court held that such words insulted the manager, slander her to sexual contact with the principal in the workplace and thus exposed her to a loss of trust necessary for the position occupied. The District Court in Kielce in its judgment of 19 October 2010 upheld the judgment.

Personal data protection, case DOLiS/DEC-1013/10 concerning DOLiS-440-276/10

September 27th, 2010, Tomasz Rychlicki

The Inspector General for Personal Data Protection (GIODO) in its decision of 13 September 2010 case file DOLiS/DEC-1013/10 concerning DOLiS-440-276/10 ruled that according to the wording of Article 18(1) pt 2 of the Polish Act of 29 August 1997 on the Protection of Personal Data – PPD – (in Polish: Ustawa o ochronie danych osobowych), unified text published in Journal of Laws (Dziennik Ustaw) of 6 July 2002, No. 101, item 926, with subsequent amendments, in the event of the breach of provisions on personal data protection, the GIODO ex officio or at the request of the person concerned, by an administrative decision, shall order the restoration of the situation in accordance with the law and, in particular, to complete, update correct, disclose or not to disclose of personal data.

Article 18
1. In case of any breach of the provisions on personal data protection, the Inspector General ex officio or upon a motion of a person concerned, by means of an administrative decision, shall order to restore the proper legal state, and in particular:
1) to remedy the negligence,
2) to complete, update, correct, disclose, or not to disclose personal data,
3) to apply additional measures protecting the collected personal data,
4) to suspend the flow of personal data to a third country,
5) to safeguard the data or to transfer them to other subjects,
6) to erase the personal data.
2. The Inspector General’s decisions referred

Given the circumstances of the case, the GIODO considered that he is authorized – by the established rules – to order the Company to disclose to the applicant information about a person who, on in 2010, at 20:29 had registered on www.gowork.pl web portal using the nickname “anonymous”, i.e. information about IP address of a computer used to post the questioned entry.

See also “Polish regulations on personal data protection” and “Polish case law on personal data protection“.

Computer crime, case V KK 391/11

September 20th, 2010, Tomasz Rychlicki

Mr Łukasz Kasprowicz publishes frequently different news and information about the municipal office at Mosina on his website (blog) available at mosina.blox.pl. Zofia Springer the Mayor of Mosina filed private charges against Mr Kasprowicz on the basis of Article 212 § 2 of the Criminal Code – CRC – (in Polish: Kodeks Karny) of 6 June 1997, published in Journal of Laws (Dziennik Ustaw) No 88, item 553, with subsequent amendments.

Article 212. § 1. Whoever imputes to another person, a group of persons, an institution or organisational unit not having the status of a legal person, such conduct, or characteristics that may discredit them in the face of public opinion or result in a loss of confidence necessary for a given position, occupation or type to activity shall be subject to a fine, the penalty of restriction of liberty or the penalty of deprivation of liberty for up to one year.

§ 2. If the perpetrator commits the act specified in § 1 through the mass media shall be subject to a fine, the penalty of restriction of liberty or the penalty of deprivation of liberty for up to 2 years.

§ 3. When sentencing for an offence specified in §1 or 2, the court may adjudge a supplementary payment in favour of the injured person or of the Polish Red Cross, or of another social purpose designated by the injured person a supplementary payment (nawiązka).

§ 4. The prosecution of the offence specified in § 1 or 2 shall occur upon a private charge.

The mayor felt insulted by some of the stories published by the blogger and concluded that the routine writing about her and the office is undermining its reputation. The Observatory of Media Freedom in Poland run by the Helsinki Foundation for Human Rights was present during the hearing as a person of trust, based on Article 361 § 3 of the Criminal Proceedings Code – CRPC – (in Polish: Kodeks Postępowania Karnego) of 6 June 1997, Journal of Laws (Dziennik Ustaw) No 89, item 555, with subsequent amendments. During the hearing on 9 May 2010, Łukasz Kasprowicz was referred by the Court for a psychiatric examination (in search for the opinion of an expert psychiatrist), and the counsel for the defence was appointed by the Court.

The Regional Court in Poznań Stare Miasto in its judgment of 25 January 2011 case file VIII K 745/09/8 sentenced Łukasz Kasprowicz for three hundred hours of community service and prohibited Mr Kasprowicz from performing professional activities as a journalist for one year, which also means the annual ban on publishing articles on the Internet. Mr Kasprowicz appealed. The District Court in Poznań in its judgment of 8 June 2011 case file IV Ka 266/11 overturned the questioned judgment. The Court acquitted Mr Kasprowicz of 13 charges, and in the other two the Court decided to discontinue the case/proceedings due to the relatively low social harm of the actions. Zofia Springer filed a cassation complaint to the Supreme Court of the Republic of Poland.

The Supreme Court in its judgment of 16 October 2012 case file V KK 391/11 decided that opinions published on websites are not different from these expressed in other media. Therefore, the assessment on the infringement of personal rights should be not applied differently.

E-access to public information, case I OSK 1727/09

September 4th, 2010, Tomasz Rychlicki

A Polish law firm requested the Office of the Attorney General of the State Treasury to disclose public information in the form of all unfavorable for the State Treasury decisions of common courts and the Supreme Court along with their written justifications, issued in 2008, in cases of reprivatization, in which the State Treasury was represented by the Attorney General of the State Treasury. The President of the Office of the Attorney General of the State Treasury refused and argued that the requested information has the nature of information processed, therefore, the applicant must also show particularly important public interest. The law firm filed a complaint against this decision.

The Voivodeship Administrative Court in its judgment of 23 September 2009 case file II SA/Wa 978/09 reversed the contested decision and held that legal commentators and the case-law formed the view that information deemed as simple is information that its substance does not change prior to its disclosure. However, the processed information is qualitatively new information that did not exist in the final content and form, although its source is in the materials held by the entity obliged to disclose such information. Thus, a fundamental feature that distinguishes processed public information from simple public information is that the authority does not posses processed public information, and for its production, it is necessary to carry out certain operations and activities on simple public information held by the entity, which results in the creation of the new quality of information. This new quality information is not only technically another compilation of existing information – another way of ranking previously held information, but different, qualitatively new information, usually leading to a specific assessment of the phenomenon, whether a particular interpretation, finding differences or similarities. In order to produce the processed information it is necessary to submit information under analysis, synthesis and produce in this way a new quality of information that does not result from the wording of any unit of information that was subject to processing, in general, it results from the sum of (a set of) individual pieces of information that has been processed. Therefore, the processed information does not results from a different order of possessed information, but from the new immanent quality that was obtained from the processing of new information. Only ranking and listing of judgments according to a specific criterion does not bear characteristic of processed information, but it has the nature of labor-intensive information, and creations of such information can only decide on the cost of production. Time-consuming, costly and organizational difficulties – technical or office that are associated with the creation and development of a public information cannot be treated as the exempt from the obligation to disclose of such information. Actions devoted to the necessary anonymization of the selected judgments do not constitute the production of processed information, because the anonymization process is a technical operation, as a result of which new information is not created.

The Supreme Administrative Court in its judgment of 3 August 2010 case file I OSK 1727/09 dismissed the cassation complaint filed by the President of the Office of the Attorney General of the State Treasury.

See also “Polish case law on e-access to public information“.

Telecommunications law, case I OSK 1079/10

August 3rd, 2010, Tomasz Rychlicki

This is the continuation of a story described in “Personal data protection, case II SA/Wa 1598/09“. The Supreme Administrative Court in its order of 15 July 2010 case file I OSK 1079/10 decided to stay the execution of the decision issued by the Inspector General for Personal Data Protection (GIODO), and ruled that the Polish Act of 16 July 2000 on Telecommunications Law – TLA – (in Polish: Prawo telekomunikacyjne), published in Journal of Laws (Dziennik Ustaw) No 171, item 1800 with subsequent amendments, provides broader protection of personal data because of telecommunications confidentiality, than the provisions of the Act of 29 August 1997 on the Protection of Personal Data – PPD – (in Polish: Ustawa o ochronie danych osobowych), published in Journal of Laws (Dziennik Ustaw) of 29 October 1997, No. 133, item 883, unified text published in Journal of Laws (Dziennik Ustaw) of 6 July 2002, No. 101, item 926, with subsequent amendments. The Court held that the disclosure of IP addresses which enable identification of specific individuals, that was ordered during administrative proceedings initiated with regard to disclosure of such data, while such proceedings did not ended with judgment in force, may violate the provisions of Article 160 of the TLA.

Article 160.
1. An entity participating in the performance of telecommunications activities within public networks and entities cooperating with it shall keep the telecommunications confidentiality.
2. Entities referred to in paragraph 1 shall maintain due diligence, within the scope justified by technical or economic reasons, while securing telecommunications equipment, telecommunications networks and data collections from disclosing the telecommunications confidentiality.
3. A person coming into possession of a message not meant to be read by him/her when using radio or terminal equipment shall keep the telecommunications confidentiality. The provisions of Article 159 (3) and (4) shall respectively apply.
4. The recording of a message acquired in a manner described in paragraph 3 by a body executing control of telecommunications activities in order to document a violation of a provision of the Act, shall not be a violation of the telecommunications confidentiality.

While assessing the validity of the request to stay the execution of GIODO’s decision to disclose the requested IP address at this stage of proceedings, the Court agreed with the author of the cassation complaint, that the execution of the questioned decision at this stage makes it impossible to reverse the actions taken after the disclosure of the IP addresses, and such action should be seen as causing the effects that are difficult to reverse according to Article 61(3) of the Act of 30 August 2002 on the Law on Proceedings Before Administrative Courts – PBAC – (in Polish: Prawo o postępowaniu przed sądami administracyjnymi), published in Journal of Laws (Dziennik Ustaw) No 153, item 1270, subsequent amendments.

§ 1 Filing a complaint does not stay the execution of the act or actions.

§ 3 After the delivery of a complaint to the court, the court may issue at the request of the applicant, the order to stay the execution, in whole or in part of the act or actions referred to in § 1, if there is a risk of causing significant damage or cause to be difficult to reverse, with the exception of the provisions of local law which entered into force, unless the special Act excludes the stay of their execution. The refusal to stay the execution of the act or actions by the authority, does not deprive the applicant of action to the court. This also applies to acts issued or adopted in all proceedings conducted within the same case.

The SAC held that if the Supreme Administrative Court would agree with the cassation complaint filed against the judgment of the Voivodeship Administrative Court of 3 February 2010 case file II SA/Wa 1598/09, the effects of the execution of the questioned decision could not be reversed, because the IP address identifying a specific person is available to another participant in the proceedings. Accordingly, the court held that the correct solution at this stage of proceedings, is to stay the execution of the questioned decision also with a view to the impact of which its execution might result in, as well as the nature of the protection of personal data resulting from the relevant regulations such as, inter alia, the TLA.

See also “Polish regulations on personal data protection” and “Polish case law on personal data protection“.

Criminal law, case III KK 234/7

July 26th, 2010, Tomasz Rychlicki

Barbara W. was charged by the Prosecutor for insulting Mieczysław W. by posting on 30 June 2005 comments regarding his peron such “erotomaniac” on a website ocen.pl that is used to evaluate academics by their students. The charges were based on the provisions of Article 212 of the Criminal Code – CRC – (in Polish: Kodeks Karny) of 6 June 1997, published in Journal of Laws (Dziennik Ustaw) No 88, item 553, with subsequent amendments.

Chapter XXVII
Offences against Honour and Personal Inviolability
Article 212
§ 1. Whoever imputes to another person, a group of persons, an institution or organisational unit not having the status of a legal person, such conduct, or characteristics that may discredit them in the face of public opinion or result in a loss of confidence necessary for a given position, occupation or type to
activity
shall be subject to a fine, the penalty of restriction of liberty or the penalty of deprivation of liberty for up to one year.
§ 2. If the perpetrator commits the act specified in § 1 through the mass media
shall be subject to a fine, the penalty of restriction of liberty or the penalty of deprivation of liberty for up to 2 years.

The case went through all instances. The Supreme Court in its order of 7 May 2008 case file III KK 234/7 dismissed the cassation filed by Mieczysław W. and ruled that the provisions of Article 216 of the CRC should be invoked in this case, instead of Article 212 of the CRC.

Article 216
§ 1. Whoever insults another person in his presence, or though in his absence but in public, or with the intention that the insult shall reach such a person,
shall be subject to a fine or the penalty of restriction of liberty .
§ 2. Whoever insults another person using the mass media,
shall be subject to a fine, the penalty of restriction of liberty or the penalty of
deprivation of liberty for up to one year.

The Court ruled that the Internet is a medium of communication, as provided for in Articles 212 § 2 and 216 § 2 of the CRC, by means of which the offender may commit both defamation and insult. However, it was impossible in the current state of the law to rule that the mere provision of a computer to a third party decides on the criminal responsibility of its owner, in case if turned out that a person using such computer would be guilty of the offense. The Court held also that freedom of the press and other mass media that is guaranteed in the Article 14 of the Constitution, should also include media, as referred to in Article 216 § 2 and 212 § 2 of the CRC.

Internet domains, case I C 2179/09

April 26th, 2010, Tomasz Rychlicki

On 2 March 2010, the District Court in Białystok I Civil Division issued in absentia judgment case file I C 2179/09, in which it ordered the defendant, a natural person known as “domain name investor” to discontinue the use of tygodnikpowszechny.pl domain name. The court ordered the defendant to publish a full-page paid ad in a weekly magazine, and two ads in two nationwide newspapers (Gazeta Wyborcza and Rzeczpospolita), with an apology defined by the Court. The court also ordered the defendant to pay the amount of 25000 PLN as compensation for infringement of personal rights of Tygodnik Powszechny sp. z o.o. company, and the amount of 15000 PLN as damages for infringement of personal rights of Father Adam Boniecki, the editor of Tygodnik Powszechny. These amounts should be transferred to Fundacji Polska Akcja Humanitarna (the Fundation Polish Humanitarian Action). The court ruled the judgment to be immediately enforceable. The judgment is final.

The court held that the use of Internet domain name may constitute a violation of personal rights taking into account the content which is visible at a website available under a given domain name. The questioned domain name was parked and directed to a website with advertising links. Such content, including texts, which were the visualization of sponsored links, constituted in Court’s opinion an infringement of personal rights.

This judgment is very important for Polish and foreign companies which became the target of cybersquatting if we consider that the Polish case law on personal interests, for instance the Appellate Court in Poznań in a judgment of 22 October 1991, case file I ACr 400/90, already established the rule that the firm under which the company conducts its business, has the same meaning in legal relations, as the name of an individual person.

See also “Polish case law on domain names“.

Personal interest, case I C 1272/09

March 19th, 2010, Tomasz Rychlicki

The District Court in Wrocław in its judgment of 18 March 2010 case file I C 1272/09 ruled that the advertising of one of the Polish banks that promoted payment cards in such a way that it used profile pictures of users of nasza-klasa.pl website infringed their personal rights. A user who logged into his or her profile was presented with an advertising that showed his or her face/image placed on credit card together with a slogan “your card for your personal account may look like this”. The Court held that users agreed to the provisions of the terms of service, but the permission to use their pictures concerned solely the purpose of social networking, not advertising. The Court ordered the owner of nasza-klasa.pl to pay the plaintiff 5000 PLN as a compensation. This judgment is not yet final.

Internet websites, case I C 1532/09

March 13th, 2010, Tomasz Rychlicki

The Observatory of Media Freedom in Poland run by the Helsinki Foundation for Human Rights reported on a case of Augustyn Ormanty, the mayor of Kalwaria Zebrzydowska town, who sued Tomasz Baluś, the administrator of naszakalwaria.pl website, for personal rights infringement after he found that the website hosted defamatory comments directed to his person. Mr. Ormanty decided to request the court to order the removal of 18 comments because he received negative response from Tomasz Baluś who claimed that these questioned statements put in the form of comments to information published at his website, are the individual opinions of people who wrote it, for the content of which, Tomasz Baluś is not responsible, because they are owned by their authors.

The District Court I Civil division in Kraków in a judgment of 11 MArch 2010 case file I C 1532/09 ruled that naszakalwaria.pl website cannot be deemed as the press according to provisions of the Polish Act of 26 January 1984 on Press law – APL – (in Polish: ustawa Prawo prasowe), published in Journal of Laws (Dziennik Ustaw) No. 5, item 24, with subsequent amendmets, because it did not meet the criterion of periodicity. The court noted that naszakalwaria.pl website is rather a collection of publications and serves as a wall on which people are able to post their comments. The court emphasized that the purpose of Internet portals, such as naszakalwaria.pl is primarily to initiate and shape public debate on issues important to the local community. The court added that the Internet is, in principle, free from control and could be subject to control only, if it fits the regulation provided in the APL. The court also stated that Augustyn Ormanty failed to prove that the offensive – in his opinion – comments related to the facts. According to the Court, they were rather opinions, which in principle cannot be judged based on the criterion of truth and falsehood.

In addition, the court held that Tomasz Baluś had a limited capacity for meticulousy checking and editing of the entries appearing on the forum of his website because of their large numbers. The court stated that the measures taken by the Mr. Baluś to search and control the entries for vulgarity and to remove obviously insulting comments were sufficient. According to the Court, Mr. Ormanty had a possibility and the right to request the removal of comments he found insulting, based on provisions of Article 14 of the Polish Act of 18 July 2002 on Providing Services by Electronic Means – PSEM – (in Polish: ustwa o świadczeniu usług droga elektroniczną), published in Journal of Laws (Dziennik Ustaw) No. 144, item. 1204 with subsequent amendments.

1. A person who gives access to the contents of a network IT system to a customer, where the customer stores data, is not aware of the illegal features of the data or activity connected with the data and upon receiving an official notification or credible information about the illegal features of the data or activity connected with it, immediately bars access to the data, shall not be responsible for the data.
2. A Service provider who has received the official notification of an illegal character of the stored data that was supplied by the customer, and prevented the access to the data, shall not be liable to the customer for damages resulting from preventing access to such data.
3. A service provider who has received credible information of the illegal character of the stored data supplied by the customer and prevented access to the data, shall not be liable to the customer for the damage resulting from preventing access to such data, if it has immediately notified the customer of the intention to prevent access to data.

The court pointed out to the argument stating that the mayor is a public figure who must reckon with the fact that its activities may be subject to criticism. As a public figure, Mr. Ormanty should show greater resistance to critical opinions, negatively evaluating the performance of the functions entrusted to him. In conclusion, the Court added that the law has not kept pace with the development of modern technology and therefore, it does not precisely regulate the issues of freedom of expression in the Internet. Therefore, the careful evaluation of such situations, is entrusted to the judges. Their task is to ensure and guarantee the freedom of expression in similar cases.

See also “Social networking sites, case I A Ca 1202/09“.

Personal interest, case I A Ca 1202/09

March 3rd, 2010, Tomasz Rychlicki

Nasza-Klasa.pl website is a very popular Polish social networking service bringing together classmates. It provides its users with a possibility to contact and search for old friends. In 2008, an unknown person created an account for the name of Dariusz B., The fake profile included his personal data: name, place of residence, phone number, age and images. This account was set without the knowledge and the consent of Dariusz B. Many offensive comments were sent from this fake account to other users of the portal. These comments provoked negative emotions and responses from its recipients. Dariusz B. and his wife, tried to apologize to every person they met. Dariusz B. was also forced to change his phone number, and met with harsh comments from friends, and especially from the strangers. Maria B. – wife of Dariusz B. contacted Nasza-Klasa.pl by e-mails with the request to remove or to block the fake account. When it did not bring any results, they brought a lawsuit against Nasza-Klasa.pl.

Nasza-Klasa.pl was found responsible by both the District and the Apellate courts because it has not removed, or at least not immediately blocked the fake account, created in the name of Dariusz B., thereby making violations of his personal interests possible.

The Appellate Court in Wrocław in its judgment of 15 January 2010 case file I A Ca 1202/09 ruled that nature of the infringement performed by Nasza-Klasa.pl was to allow a third party to encroach on personal rights of Dariusz B., by not fulfilling its obligations under the Polish Act of 18 July 2002 on Providing Services by Electronic Means – PSEM – (in Polish: ustwa o świadczeniu usług droga elektroniczną), published in Journal of Laws (Dziennik Ustaw) No. 144, item. 1204 with subsequent amendments.

Article 14
1. A person who gives access to the contents of a network IT system to a customer, where the customer stores data, is not aware of the illegal features of the data or activity connected with the data and upon receiving an official notification or credible information about the illegal features of the data or activity connected with it, immediately bars access to the data, shall not be responsible for the data.

2. A Service provider who has received the official notification of an illegal character of the stored data that was supplied by the customer, and prevented the access to the data, shall not be liable to the customer for damages resulting from preventing access to such data.

3. A service provider who has received credible information of the illegal character of the stored data supplied by the customer and prevented access to the data, shall not be liable to the customer for the damage resulting from preventing access to such data, if it has immediately notified the customer of the intention to prevent access to data.

According to the Court, Nasza-Klasa.pl did not immediately block, and then delete the questioned fake account. Therefore, it forced Dariusz B. to bear a humiliating behavior caused by another person, which in consequence violated his serenity, good mood, sense of personal dignity, i.e. his personal interests. However, the Court did not agree with the argument that the standard of conduct, professionalism, requires the administrator to filter and delete statements that violate the law or may violate the law in an objective view, without a prior notice regarding such event. Putting such a requirement would be contrary to the provisions of Articles 14 and 15 in connection with Article 12 of the PSEM.

Internet domains, case I ACz 232/10

February 14th, 2010, Tomasz Rychlicki

As polite fans would probably say, the condition of Polish football is at least “debatable”, and others might use more crude words. The corruption and inefficient management of the Polish national football leagues are the tip of the Iceberg. This situation causes frustration of many people who try to blame the Polish Football Association (PZPN) for all their miseries. Some of these people decided to take matters into their own hands. They formed the Association of Defenders and Supporters of the Polish Football. They registered koniecpzpn.pl (end of Polish Football Association) as an Internet domain name and started to host a website with critical publications on PZPN under that domain. One didn’t need to wait too long before lawyers representing the Polish Football Association entered “the game”. New players acting on behalf of the Polish Football Association requested the court to issue a preliminary injunction in order to secure the case for the future action for trade mark protection and for the protection of personal rights.

The District Court in Lódż, I Civil Division, in its order of 14 January 2010, case file I Co 203/09 granted the injunction and ordered the prohibition of placing at koniecpzpn.pl website the following trade marks owned by PZPN: R-142616, R-170024, R-188961 and R-188962, the Court also ordered a block on the access to the content of the website available under www.koniecpzpn.pl domain name. The Court set the PZPN a two-week deadline for lodging the petition instituting proceedings for trade mark protection and the protection of personal rights under the pain of withdrawing the injunction in case no lawsuit was filed by that date.

The Appellate Court in Łódź in its decision of 24 March 2010 case file I ACz 232/10 annulled the injunction. The Court held that PZPN did not exactly specified which claims it intends to enforce. The Court ruled that all claims should be precisely specified in the request because the lack of precise claims make impossible to verify whether conditions for the injunction are met, i.e. whether the claim is reliable and the applicant has legal interest (locus standi) in enforcing it. The Court also noted that the injunction would be unduly restrictive and burdensome beyond measure. According to the Court the blocking of a website could be considered as inadmissible preventive censorship.

See also “Polish case law on domain names“.

Personal data protection, case I OSK 667/09

February 13th, 2010, Tomasz Rychlicki

On 15 January 2008, Tomasz W. filed with the General Inspector for Personal Data Protection (GIODO) a complaint concerning an unauthorized processing of personal data carried out by the Polish company Nasza Klasa Sp. z o.o. from Wroclaw, the owner of nasza-klasa.pl website. He informed the GIODO, that this very popular Polish website on classmates, hosts a photo featuring his image together with a list of names of other photographed people attached to it. Tomasz W. has repeatedly appealed to the website administrators with the request to remove his name from the list. However, he received no response from Nasza Klasa company.

As a result of the investigation, the GIODO found that on 31 December 2007, a registered user of nasza-klasa.pl posted classmates’ photo featuring students of a primary school. On the same day, another registered user, placed the names of people who were portrayed at the photograph – including the name and surname of Tomasz W. On 2, 9 and 14 January 2008, Tomasz W. requested Nasza Klasa Sp. z o.o. the removal of his personal data.

In a decision of 27 May 2008, case file DOLiS/DEC-314/08/13239, the GIODO, relying on the provisions of the Polish Act of 29 August 1997 on the Protection of Personal Data – PPD – (in Polish: Ustawa o ochronie danych osobowych), published in Journal of Laws (Dziennik Ustaw) of 29 October 1997, No. 133, item 883, unified text published in Journal of Laws (Dziennik Ustaw) of 6 July 2002, No. 101, item 926, with subsequent amendments, ruled that information on the applicant’s full name, school and class to which he attended, together with his image, are personal data and the data collector is Nasza Klasa Sp. z o.o.

However, the GIODO also ruled that it should be borne in mind that according to the provision of the Polish Act of 18 July 2002 on Providing Services by Electronic Means – PSEM – (in Polish: ustwa o świadczeniu usług droga elektroniczną), published in Journal of Laws (Dziennik Ustaw) No. 144, item. 1204 with subsequent amendments, Nasza Klasa sp. z o.o. provides electronic services for registered users of the portal website, consisting of the storage of data of these users in the computer system. This activity is the condition to legalize the processing of personal data in accordance with article 23(1) pt. 5 of the PPD. In addition, the GIODO found that in this case the applicant’s rights have not been violated, because the access to its data was limited to a group of people registered on nasza-klasa.pl website.

Tomasz W. asked the GIODO for the retrial. He pointed out that the reasons for the decision have many contradictions, inconsistencies and is ambiguous. He accused the GIODO of laconic and cursory treatment of his case. He again emphasized that his personal data have been published on the nasza-klasa.pl website without his knowledge or consent, in violation of his civil rights and liberties.

After the rehearing of the case, the GIODO annulled the contested decision, and discontinued the proceedings. GIODO claimed that the re-examination of the case leads to the conclusion that the disputed information about Tomasy W. did not fall within the definition of personal data. The name and surname have been given under his old image from many years ago. Hence, the combination of photos from the past, with a name and surname of a person and a primary school, which such person attended did not allow for the identification of a person without excessive costs and time. The findings that the disputed information is not personal data within the meaning of the PPD caused the proceedings in the matter to be groundless and on the basis of article 105 § 1 of the APC, it had to be discontinued.

Tomasz W. lodged a complaint with the Viovodeship Administrative Court in Warsaw. The complainant asked for annulment of the decision of first and second instance. Tomasz W. claimed the violation of the substantive law, i.e. article 6(1) of the PPD, through its improper interpretation, of article 32(1) pt 7 and 8 of that Act, by recognizing that Tomasz W. is not entitled to request cessation of the processing of his data and the right to object, and a breach of article 7 of the APC by not explaining all the relvant facts. Tomasz W. disagreed with the statement of the GIODO that questioned information about his person is not personal data within the meaning of the PPD. He stated that any information about an identified or identifiable individual is personal data. Furthermore, he argued that the claim of the GIODO that the data are available only for specific people – registered users of the portal is not acceptable, because nasza-klasa.pl has no mechanisms for verification of users identity, which makes the questioned data easily accessible for everyone. Moreover, Tomasz W. also argued that a registered user who does not know him would have some difficulty in identifying his person but such obstacles would not happen to a person who knows about Tomasy W., and is looking for additional information.

The Voivodeship Administrative Court in its judgment of 3 March 2009 case file II SA/Wa 1495/08 ruled that the GIODO erred in its decisions, because information about the name and surname of Tomasz W., combined with information about the name and address of the primary school and the determination of the class to which he attended in 1978/79, even if it was thirty years ago, are personal data. According to the Court provisions of article 1 of the PPD introduced the principle of autonomy of human information, meaning the protection of information about human being. This provision is a kind of emanation of the general right guaranteed by the Polish Constitution in article 47, according to which “Everyone shall have the right to legal protection of his private and family life, of his honour and good reputation and to make decisions about his personal life”. This means that the protection of personal data is related to the protection of privacy rights. This follows from the wording of article 6 of the PPD, indicating that the personal data concern identified or identifiable natural or legal person and that the identifiable is a person is one whose identity can be determined. From wording of that provisions the VAC concluded that personal data are data that identify a person’s identity. The VAC also relied on the content of recital 12 of the Directive 95/46/EC of the European Parliament and of the Council of 24 October 1995 on the protection of individuals with regard to the processing of personal data and on the free movement of such data, which emphasized the protection of all data relating to a person, and therefore also information about someones past.

(12) Whereas the protection principles must apply to all processing of personal data by any person whose activities are governed by Community law; whereas there should be excluded the processing of data carried out by a natural person in the exercise of activities which are exclusively personal or domestic, such as correspondence and the holding of records of addresses

However, in recital 26 of the abovementioned Directive states that data protection rules must apply to any information concerning an identified or identifiable person. In order to determine whether a person is identifiable, all the means which can be used by the controller or any other person to identify a person, should be taken into the account. The rules of data protection do not apply to data rendered anonymously in such a way that a subject of the data can not be identified. The identification of a given person concerns also past information about a specific human being, by which information one can learn about such person’s identity. Accordingly, the VAC held that European law means the protection of personal data as the protection of all the facts concerning the past of a particular person, which corresponds with the content of article 6(2) of the PDP. So this means that such data would also be protected. Referring to the foregoing facts of Tomasz W. case, the VAC ruled that that nasza-klasa.pl website published his image and name. In the opinion of the court these are the personal data which are protected by the PPD, because on their basis one is able to identify given person.

Nasza Klasa sp. z o.o. filed a cassation complaint with the Supreme Administrative Court (SAC) challenging in entirety the judgment of the VAC. The Supreme Administrative Court in a judgment of 18 November 2009, case file I OSK 667/09, rejected the complaint. The SAC held that the primary issue arising in this case was whether a classmates’ picture that was taken thirty years ago, at which Tomasz W. is potrayed, in the circumstances of the case, can be analyzed to determine his identity without necessarily involving excessive resources or time, and therefore, whether the data disclosed in the photo in question, constitutes personal data within the meaning of article 6 of the PPD, and whether it should be protected.

The concept of “personal data” on the Polish law includes any information concerning an individual if it is possible to define its identity and its identification. Personal data is a set of messages about a particular person such integrated that it allows for its individualization. It includes at least information necessary for identification (name, surname, place of residence), but this is not restricted, because it also include further information, strengthening the degree of identification. Such information will also include pictures of the individual, even if they were taken in the past, allowing to identify a person. In a situation where such a photograph is presented with a name and surname of the person portrayed, in a place accessible to an unlimited number of entities, it must be considered that it constitutes personal data subject to protection under the PPD. Mainly, the objective evaluation criteria decides for the qualification of given information as personal data, but it also should comprise of all information, including extralinguistic (context), to which third party may have or has an access. A different approach to the presented issues would maginalize the importance of the laws and it would not relate to its designated function.

Thus it should be considered that the image of Tomasz W. portrayed at the photograph that was taken 30 years ago, affixed with the class, his name and surname, and then published at nasz-klasa.pl website constitutes personal data within the meaning of article 6(2) of the PPD, and the cassation complaint was not justified. The SAC also noted that the consent for the processing of personal data cannot be in any way implied.

The SAC also stressed the fact the Internet as a source of information is increasing on a unknown scale and importance. It provides an access to specific information to a vast number of persons and allows for any of its processing within the meaning of the PPD. At the same time there are not yet developed appropriate mechanisms for the protection of individual rights when those rights have been violated as a result of the disclosure of information on the Internet. Then, it is a great role of law enforcement bodies, including the Inspector General for Personal Data Protection in creating practice to comply with applicable laws also on the Internet. It is an unacceptablr situation in which the entity seeks to remove its image from a particular website, and the administration fails to take action to ensure the protection of civil rights. The image is one of the very personal property rights and lack of consent to its publication, if it is not a public person, is a sufficient reason to believe that regulations of the PPD apply, if the conditions set in the article 6(2) of the PPD have been met. There is a legal sequel to this story. See “Personal data protection, case II SA/Wa 1212/10“.

See also “Polish regulations on personal data protection” and “Polish case law on personal data protection“.

Personal data protection, case II SA/Wa 71/07

February 12th, 2010, Tomasz Rychlicki

A lawyer representing one Polish entrepreneur, and as you already know personal data of the parties are removed from Polish courts’ judgments, requested the General Inspector for Personal Data Protection (GIODO) to issue an order to Home.pl company from Szczecin, to disclose personal data such as name, surname, the firm, address, office’s seat, phone number and e-mail address of a person, which had only published its caller id, and who registered a certain Internet domain name. The lawyer stated that his client is claiming the right to use the questioned domain name and the requested information is necessary for the initation of the arbitration proceedings before the Court of Conciliation at the the Polish Chamber of Information Technology and Telecommunications.

Home.pl refused to provide the abovementioned personal data, arguing that the parties of the legal relationship arising from the fact of the registration and maintenance of Internet domain names are the Research and Academic Computer Network (in Polish: Naukowa i Akademicka Sieć Komputerowa) – the national registry of the .pl domain, and the domain name subscriber.

The GIODO performed an investigation based on the administrative proceedings regulations. The GIODO did an inspection of the Company’s headquarters and found that Home.pl maintains a separate collection of data of subscribers who have registered their domain names in NASK through Home.pl services. NASK is the national domain name registrar, while Home.pl arranges for the registration and maintenance of Internet domain names. Home.pl represents an applicant for the domain name registration before NASK. A natural or legal person and Home.pl have to establish a legal relationship based on a registration contract in order to register the domain name in NASK. The legal relationship is based on registering and maintaining of the internet domain name. The GIODO found that in this case, the contested domain name was registered by a natural person.

In September 2006, the General Inspector for Personal Data Protection issued an administrative decision which ordered Home.pl to disclose personal data of the individual who registered the Internet domain name in question, the name, surname, address, phone number and e-mail address. Home.pl requested for a retrial of the case. The GIODO upheld the decision and Home.pl filed a complaint against it.

The Voivodeship Administrative Court (VAC) in Warsaw in its judgment of 30 Novmeber 2007 case file II SA/Wa 71/07 ruled that the complaint was based on Article 29(2) in connection with Article 22 of the Polish Act of 29 August 1997 on the Protection of Personal Data – PPD – (in Polish: Ustawa o ochronie danych osobowych), published in Journal of Laws (Dziennik Ustaw) of 29 October 1997, No. 133, item 883, unified text published in Journal of Laws (Dziennik Ustaw) of 6 July 2002, No. 101, item 926, with subsequent amendments.

Article 29
1. In case of providing the access to the data for the purposes other than including into the data filing system, the controller shall disclose the data kept in the data filing system to persons or subjects authorised by the law.
2. Personal data, exclusive of data referred to in Article 27 paragraph 1, may also be disclosed, for the purposes other than including into the data filing system, to persons and subjects other than those referred to in paragraph 1 above, provided that such persons or subjects present reliably their reasons for being granted the access to the data and that granting such access will not violate the rights and freedoms of the data subjects.
3. Personal data are disclosed at written and justified requests, unless the provisions of another law state otherwise. Such requests should include information allowing for identification of the requested personal data within the filing system and indicating their scope and purpose.
4. Disclosed personal data shall be used only pursuant to the purpose for which they have been disclosed.
(…)
Article 22
The proceedings with respect to the matters regulated by this Act shall be conducted pursuant to the provisions of the Code of Administrative Procedure, unless other provisions of the law state otherwise.

According to the VAC, the provisions of Article 29(1) and (2) allow third parties to request the disclosure of personal data for purposes other than inclusion in the collection. It should be noted that these provisions being in force until 1 May 2004, gave no grounds to demand the disclosure if the controller was the private sector. This situation changed after the amendment of 22 January 2004. The Court noted that the request for disclosure of personal data may be filed by any person i.e. natural person, any organizational unit, both public and private. It is important that the possesion of personal data is necessary to achieve intended goals, and the request for personal data is credible and reasonable. Such request does not require a collector to disclosure personal data because it must assess whether the conditions have been met to provide such data according to provisions of Article 29 of the PPD.

1. In case of providing the access to the data for the purposes other than including into the data filing system, the controller shall disclose the data kept in the data filing system to persons or subjects authorised by the law.
2. Personal data, exclusive of data referred to in Article 27 paragraph 1, may also be disclosed, for the purposes other than including into the data filing system, to persons and subjects other than those referred to in paragraph 1 above, provided that such persons or subjects present reliably their reasons for being granted the access to the data and that granting such access will not violate the rights and freedoms of the data subjects.
3. Personal data are disclosed at written and justified requests, unless the provisions of another law state otherwise. Such requests should include information allowing for identification of the requested personal data within the filing system and indicating their scope and purpose.
4. Disclosed personal data shall be used only pursuant to the purpose for which they have been disclosed.

However, the VAC stressed that fact that collector’s discretion cannot mean its arbitrariness. In the case of the unfounded refusal to provide personal data according Article 29 (2) of the PPD, the General Inspector for Personal Data Protection shall have the right – in accordance with Article 18(1) pt. 2 of the PPD – to require the disclosure of personal data.

1. In case of any breach of the provisions on personal data protection, the Inspector General ex officio or upon a motion of a person concerned, by means of an administrative decision, shall order to restore the proper legal state, and in particular:
(…)
2) to complete, update, correct, disclose, or not to disclose personal data,

Undoubtedly, the request for the disclosure of personal data must be credible and legitimate. Thus, if such request is do not precluded by provisions of article 27 of the PPD, the collector must disclose such data.

1. The processing of personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, religious, party or trade-union membership, as well as the processing of data concerning health, genetic code, addictions or sex life and data relating to convictions, decisions on penalty, fines and other decisions issued in court or administrative proceedings shall be prohibited.
2. Processing of the data referred to in paragraph 1 above shall not constitute a breach of the Act where:
1) the data subject has given his/her written consent, unless the processing consists in erasure of personal data,
2) the specific provisions of other statute provide for the processing of such data without the data subject’s consent and provide for adequate safeguards,
3) processing is necessary to protect the vital interests of the data subject or of another person where the data subject is physically or legally incapable of giving his/her consent until the establishing of a guardian or a curator,
4) processing is necessary for the purposes of carrying out the statutory objectives of churches and other religious unions, associations, foundations, and other non-profitseeking organisations or institutions with a political, scientific, religious, philosophical, or trade-union aim and provided that the processing relates solely to the members of those organisations or institutions or to the persons who have a regular contact with them in connection with their activity and subject to providing appropriate safeguards of the processed data,
5) processing relates to the data necessary to pursue a legal claim,
6) processing is necessary for the purposes of carrying out the obligations of the controller with regard to employment of his/her employees and other persons, and the scope of processing is provided by the law,
7) processing is required for the purposes of preventive medicine, the provision of care or treatment, where the data are processed by a health professional subject involved in treatment, other health care services, or the management of health care services and subject to providing appropriate safeguards,
8) the processing relates to those data which were made publicly available by the data subject,
9) it is necessary to conduct scientific researches including preparations of a thesis required for graduating from university or receiving a degree; any results of scientific researches shall not be published in a way which allows identifying data subjects,
10) data processing is conducted by a party to exercise the rights and duties resulting from decisions issued in court or administrative proceedings.

The Court had to consider the question of whether the application met the conditions set in Article 29 of the PPD. The legal representative proved that, the disclosure of personal data of a person who registered the disputed domain because was necessary for the initation of the arbitration proceedings before the Court of Conciliation at the the Polish Chamber of Information Technology and Telecommunications. The Court noted that the arbitration proceedings are held in accordance with Article 1188 § 1 of the Civil Proceedings Code – CPC – (in Polish: Kodeks Postępowania Cywilnego) of 17 November 1964, published in Journal of Laws (Dziennik Ustaw) No 43, item 296, with subsequent amendments. The proceedings before the Court of Conciliation starts with the lodging of the statement of claim (the suit), which means that the suit should comply with the conditions laid down in Article 187 § 1 of the CPC. Under that provision, the statement of claim should meet the requirements of the pleading, and it also shall include: clearly defined demand in matters of property rights and the value of the claim, unless the case concerns the amount of money. The suit shall include all facts justifying the request and, if necessary, to justify the jurisdiction of the court. In accordance with Article 126 § 1 pt. 1 of the CPC, every pleading shall also contain, inter alia, the designation of the court to which it is addressed, the name or names of the parties, their legal representatives and/or agents. Therefore, the essential element of the claim for infringement of personal rights is to show the person against whom the request is addressed, i.e. the defendant in future proceedings for infringement of personal rights, and defendant’s address. The VAC found that the request in the Home.pl case was fully justified. The Court also confirmed that Home.pl is the controller within the meaning of Article 7(4) of the PPD, because according to the agreement with NASK, Home.pl decides on the purposes and means of the processing of personal data related to people who registered domain names. Thus, the party of the case was Home.pl, not NASK.

See also “Polish regulations on personal data protection“, “Polish case law on personal data protection” and “Polish case law on domain names“.

Personal data protection, case I OSK 1079/10

February 5th, 2010, Tomasz Rychlicki

According to lawyers representing the singer Maryla Rodowicz, on the forum of one of the Polish portal websites appeared entries with the content which allegedly violated her personal rights (interests). The lawyers requested the owner to reveal IP addresses of users who posted these entries. The administrator of the portal website deleted the disputed entries but did not reveal any of the IP addresses. Lawyers filed a request to the Inspector General for Personal Data Protection (GIODO), who ordered the portal to disclose IPs on the grounds that these numbers are personal data. The owner of the portal again refused. The case went to the Voivodeship Administrative Court (VAC) in Warsaw, which in a judgment of 3 February 2010, case file II SA/Wa 1598/09 upheld the decision of the GIODO. The company who owns the portal may file a cassation to the Supreme Administrative Court (SAC). The VAC judgment provides the interpretation that IP address is a personal data, in accordance with the statutory definition included in article 6 of the Polish Act of 29 August 1997 on the Protection of Personal Data – PPD – (in Polish: Ustawa o ochronie danych osobowych), Journal of Laws (Dziennik Ustaw) of October 29, 1997, No. 133, item 883, unified text published in Journal of Laws (Dziennik Ustaw) of July 6, 2002, No. 101, item 926, with later amendments.

Article 6
1. Within the meaning of the Act personal data shall mean any information relating to an identified or identifiable natural person.
2. An identifiable person is the one who can be identified, directly or indirectly, in particular by reference to an identification number or to one or more factors specific to his/her physical, physiological, mental, economic, cultural or social identity.
3. A piece of information shall not be regarded as identifying where the identification requires an unreasonable amount of time, cost and manpower.

The VAC also noted that the IP address is personal data if it is permanently assigned to the specified device, and that device is used or operated by a specified entity. This dependence makes certain, in given situations, that there is the possibility of identifying such entity. The Court said that it is true that the IP address itself is not sufficient to identify a person who use it, but together with other information a person can be identified. Grupa o2, the owner of a portal website filed a cassation complaint.

The Supreme Administrative Court in its judgment of 19 May 2011 case file I OSK 1079/10 dismissed the complaint and decided that information on the date and contents of the posts that are correlated with IP addresses, allows for unambiguous determination of identity of persons who have violated someone’s personal interests.

There was another court’s decision with regard to the aforementioned case and the disclosure of IP addresses. See “Telecommunications law, case I OSK 1079/10“. The U.S. courts and judges have quite different views on this issue. Read for example Johnson v. Microsoft Corp., 2009 WL 1794400 (W.D. Wash. June 23, 2009).

See also “Polish regulations on personal data protection” and “Polish case law on personal data protection“.

Database protection, case V CSK 150/07

October 2nd, 2009, Tomasz Rychlicki

The Supreme Court in its judgment of 24 august 2007 case V CSK 150/07 held that an agreement on the use of the database is acceptable under the rule of contractual freedom, and it is similar to a typical license agreements. The contract for the work belongs to a group of contracts assigning ownership of the material components supplied by the contractor. If the work is deemed as the computer system then the contract transfers to the conctractor any copies of copyright works and databases that are not works and gives him the right to use them as intended, although copyright as a property right is not transferred to the contractor.

E-access to public information, case I OSK 190/06

September 4th, 2009, Tomasz Rychlicki

On 6 June 2004, the editor in chief of one of the Polish magazines requested the Minister of Internal Affairs and Administration for access and disclosure of the list of entrepreneurs who have been authorized to carry out business activity in the detectives and investigation services. The spokesman of the Minister replied that the registry of companies to whom such permits and licenses have been granted, as a whole, constitutes a database within the meaning of Article 2(1) point 1 of the Polish of 27 July 2001 on Protection of Databases – APD – (in Polish: Ustawa o ochronie baz danych), published in Journal of Laws (Dziennik Ustaw) No. 128, item 1402 with subsequent amendments. The whole structure of the registry is subject to legal protection and the its individual availability must be understood as the possibility to receive information about a specific item of the database. There are no procedural obstacles that the interested parties may receive information or data about a particular entrepreneur to whom the permit has been issued. So, as a general rule, the access to information contained in the registry is open, it does not mean, however, that the entire database should be disclosed – as a legal structure. The magazine filed a complaint on failure to act. The case went through all instances.

The Supreme Administrative Court in its judgment of 14 March 2006 case file I OSK 190/06 dismissed it the cassation complaint filed by the editorial team of the magazine.

See also “Polish case law on e-access to public information“.

Press law, case VI Ka 202/09

August 3rd, 2009, Tomasz Rychlicki

This is the continuation of a story described in “Press law, case II K 367/08“. The District Court in Słupsk in its judgment of 18 June 2009 case file VI Ka 202/09 held that gby.pl – a portal website operated by Leszek Szymczak constituted press under the Press law, however, comments posted on this website by the Internauts do not constitute a press material for the content of which the website administrator could be held responsible. The District Court held that the posts are not letters to the editor or are not – as the Prosecutor argued – “quasi-letters” to the editor. The court said that the posting process on an internet forum is made automatically, there is no prior moderation of such messages.

The administrator of a portal website, which allows for posting comments, is the hosting service provider and is subject to regulations included in Article 14 of the Polish Act of 18 July 2002 on Providing Services by Electronic Means – PSEM – (in Polish: ustwa o świadczeniu usług droga elektroniczną), published in Journal of Laws (Dziennik Ustaw) No. 144, item. 1204 with subsequent amendments.

1. A person who gives access to the contents of a network IT system to a customer, where the customer stores data, is not aware of the illegal features of the data or activity connected with the data and upon receiving an official notification or credible information about the illegal features of the data or activity connected with it, immediately bars access to the data, shall not be responsible for the data.
2. A Service provider who has received the official notification of an illegal character of the stored data that was supplied by the customer, and prevented the access to the data, shall not be liable to the customer for damages resulting from preventing access to such data.
3. A service provider who has received credible information of the illegal character of the stored data supplied by the customer and prevented access to the data, shall not be liable to the customer for the damage resulting from preventing access to such data, if it has immediately notified the customer of the intention to prevent access to data.

The Court ruled that the service provider cannot be held liable for material posted by its users. The court noted that the decision does not mean that no one should be held liable for the posts that contain an offensive material that is a subject to criminal prosecution. The responsibility for this activity should be borne by a direct perpetrator and the prosecution authorities should identify such persons by using the available technical resources (IP addresses). The Prosecution cannot go after the smallest line of resistance and charge the administrators, instead of the actual perpetrators.

See also “Press law, case VI Ka 409/07” and “Internet websites, case I C 1532/09“.

Copyright law, case I ACa 1145/06

August 2nd, 2009, Tomasz Rychlicki

The Appeallate Court in Warszawa in its judgment of 11 May 2007 case file I ACa 1145/06 held that creation of layout and graphic form of the portal, as well as its improvement and change over the use of such a web portal is in the definition of a copyrightable work as provided in the Polish Act of 4 February 1994 on Authors Rights and Neighbouring Rights – ARNR – (in Polish: ustawa o prawie autorskim i prawach pokrewnych), published in Journal of Laws (Dziennik Ustaw) No 24, item 83, consolidated text of 16 May 2006, Journal of Laws (Dziennik Ustaw) No 90, item 631 with subsequent amendments.

See also “Polish regulations on copyright” and “Polish case law on copyright“.

Personal data protection, case II SA/Wa 1495/08

March 30th, 2009, Tomasz Rychlicki

The Voivodeship Administrative Court in Warsaw in its judgment of 3 March 2009, case file II SA/Wa 1495/08 decided on the protection of personal data and providing and operating online services such as websites about users’ classmates. The VAC ruled that in accordance with article 6(2) of the Polish Act of 29 August 1997 on the Protection of Personal Data – PPD – (in Polish: Ustawa o ochronie danych osobowych), unified text published in Journal of Laws (Dziennik Ustaw) of 6 July 2002, No. 101, item 926, with subsequent amendments, not only information on the current situation of an individual decide whether one is dealing with personal data, but also information relating to what a person did and who one was in the past. It means that such data are protected under the Act on Protection of Personal Data.

See also “Polish regulations on personal data protection” and “Polish case law on personal data protection“.

Personal rights, case II CSK 539/07

March 27th, 2009, Tomasz Rychlicki

The company QXL Poland sp. z o.o. is the owner of the allegro.pl auction website which removed the user account of a natural person (Cezary O.) who was using the nicknames CezCez, 2cez, 2xcez and espia. The company presented different reasons for its decision to remove the account and tried to justify such action by putting various statements about CezCez on its forum website “Cafe Nowe Allegro”. CezCez did not agree with QXL’s statements and sued. The court of first instance agreed with Cezary O.’s arguments and ruled that QXL Poland make a statement of apology as follows

Allegro.pl wishes to apologize to CezCez for using comments by one of its employees which publicly appeared on the New Cafe Allegro on 17 January 2003,– wording that implied CezCez was dishonest, he lies, he is selfish and that he pursues his own self-interest. These actions and comments affected the good name of CezCez, which was not the intention of QXP Poland.

The above statement was to be published on the Allegro.pl website but both parties appealed. The Appellate Court in Lodz did not share the conclusions of the court of first instance that the username (a nickname) used in internet services is personal right/interests (i.e. intangible personal property) eligible for protection under Articles 23 and 24 of the Civil Code – CC – (in Polish: Kodeks Cywilny) of 23 April 1964, published in Journal of Laws (Dziennik Ustaw) No. 16, item 93, with subsequent amendments.

Article 23
The personal interests of a human being, in particular to health, dignity, freedom, freedom of conscience, surname or pseudonym, image, secrecy of correspondence, inviolability of home, and scientific, artistic, inventor’s and rationalizing achievements, shall be protected by civil law independent of protection envisaged in other provisions.

Article 24
§ 1 The person whose personal rights are threatened by someone else’s action, may require the desist of that action, unless it is not illegal. In the event of the infringement one may also require, the person who committed the violation, to fulfill the actions necessary to remove its effects, in particular, to make a statement of the relevant content and appropriate format. According to the conditions laid down in the Code one may also require monetary compensation or payment of an appropriate amount of money for a social purpose indicated.
§ 2 If as the result of a breach of personal rights one has suffered pecuniary prejudice, the aggrieved person may claim compensation based on general principles.
§ 3 The above shall not prejudice the entitlements provided by other regulations, in particular in copyright law and the patent (invention) law.

The Appellate Court did not agree with the arguments that the user name (a nickname) has parallels with a pseudonym. The case went to the highest court in a further appeal as a cassation complaint. The Supreme Court of Republic of Poland in its judgment of 11 March 2008 case file II CSK 539/07 dismissed the case for procedural reasons. However, the SC did not agree with conclusion of the Appellate Court with regard to protection of nicknames or usernames in the digital environment. The court noted that a username fulfils a variety of functions. First, the creation of a username is a prerequisite to registering on the allegro.pl website in order to obtain its own account and so participate in auctions. A person using such a nickname may be a buyer or a seller. Secondly, a username allows a person to log into Allegro.pl website. In the process of logging in, the user is given a pair of identifiers, such as a username and password. Thirdly, the username/nickname identifies the individual in question in the online environment, in this particular case, in the environment of people using Allegro.pl services. The individual is therefore recognised as a user using a specific nickname. The Supreme Court could not agree with the position of Court of Appeal that the nickname is purely a technical issue used to personalise the operation. On the contrary it argued, the username/nickname defines and characterises the person who uses such an auction site, bids on it, is the party to a contract of sale, issues comments or is involved in correspondence with other users. The Court found that in some cases, participations in the auction website by a user using a specific name can be a source of information for other participants who know that this user typically takes part in an auction of that type, bids only to a certain amount of money, only on certain days, in a certain way, does not compete with users using specific names, that the user is honest, efficient and immediately carries out transactions, etc. The Supreme Court also ruled that a username identifies a specific natural person. A username consists of a series of signs and letters, and there are no counter-indications that a person who created his or her own username could use his or her own name, surname, artistic pseudonym, pen name, or alias or it could even be a natural person who is the agent and uses the company name (the firm) under which it operates its business. It appeared to the court that in the assumption of a username by a person rather than his or her own name, the pseudonym (which has so far been used as an example in artistic activities) is meant as the assumption of a nickname in order to allow for individualisation of that particular person. The word “nickname” comes from the Greek language (“pseudonymos”–bearing a false name, falsely named) and it means a first name, last name or another name which someone uses to conceal his real name or surname. The court found irrelevant the motivation of a person who takes a nickname which is used as a pseudonym only in the “internet environment” or that the nickname may only be associated with the activities of that particular person carried out within the scope of services offered by Allegro.pl, since it may also have a broader meaning and go beyond the services of Allegro.pl. Consequently, the court noted that a username is subject to legal protection on the same basis on which protection is granted for any name, pseudonym or firm name, under which a person has established its business (whether it is a company name or that of a private person). At the same time, the court found no reason to treat a username/nickname as a separate personal right.

Criminal law, case III KK 234/07

February 20th, 2009, Tomasz Rychlicki

The Supreme Court Criminal Chamber in its judgment of 7 May 2008 case file III KK 234/07 held that the freedom of the press and other means of social communication that are guaranteed in the Article 14 of the Polish Constitution, also include mass media communication, as referred to in 216 § 2 i 212 § 2 of the Criminal Code. The Court noted that Internet is deemed as a means of mass communication, whereby the offender may commit both the defamation and insult. The case concerned defamation via the Internet. The investigation established only a computer that was used to commit this type of offence. The Court observed that it is not possible to automatically connect a computer with a perpetrator. The Court ruled that there is a possibility to establish and determine the IP address to identify the owner of a specific computer, which has been used for defamatory or insulting actions, but there is no possibility to indicate who used such computer, if adequate evidence was not collected, and if the owner does not indicate the person who committed the offence. Sharing a computer with a third person is not a wrongful act. It is impossible in the current state of the law to recognize that the mere act of sharing of a computer with a third person results in criminal liability of its owner.

Press law, case II K 367/08

January 14th, 2009, Tomasz Rychlicki

The Regional Court in Słupsk in its judgment of 16 December 2008, case file II K 367/08 acquitted Leszek Szymczak from charges of publishing press material featuring criminal content that publicly incited its readers to commit offences. This case concerned posts that were published at the online forum of http://gazetabytowska.pl website (also accessible at http://gby.pl), which – according to the Public Prosecutor’s Office – included incitement to commit crime. Charges were based on Article 49a of the Polish Act of 26 January 1984 on Press law – APL – (in Polish: ustawa Prawo prasowe), published in Journal of Laws (Dziennik Ustaw) No 5, item 24, with subsequent amendments.

An editor who unintentionally published press material that featured criminal content mentioned in article 37a hereof, shall be subject to a fine penalty or the restriction of liberty.

In connection with the provisions of Article 255 of the Polish Criminal Code – CRC – (in Polish: Kodeks Karny) of 6 June 1997, published in Journal of Laws (Dziennik Ustaw) No 88, item 553, with subsequent amendments.

1. A person who publicly calls for committing an offence of a fiscal crime shall be subject to a fine penalty, the restriction of liberty or imprisonment for up to two years.
2. A person who publicly calls for committing a crime shall be subject to the restriction of liberty for up to three years.
3. A person who publicly praises the commitment of a crime shall be subject to a fine penalty amounting to up to 180 daily rates, the restriction of liberty or imprisonment for up to one year.

The Court ruled that according to the provisions of Polish Press Law, Leszek Szymczak is the publisher and the editor, however the entries that were posted by visitors of his website did not constitute a press material. The appeal brought by the Prosecutor Office was rejected. See “Press law, case VI Ka 202/09“.

See also “Press law, case VI Ka 409/07” and “Press law, case IV KK 174/07“.

Press law, case VI Ka 409/07

January 14th, 2009, Tomasz Rychlicki

Facts and legal dispute
A Polish TV channel, TVN, in its show entitled UWAGA broadcast footage that criticised the work of a debt collector, Wojciech D., who held office in a Pomeranian town of Bytów. Internauts were prompt to comment on his work. This boiled down mostly to offensive statements, some of which are provided below:

I suggest we lynch the guy, if legal methods failed. It seems that we’ll have to fight impudence with impudence! Citizens!!! This goes out to you.

How about we settled it ourselves, people? We could take him to the woods, take away his clothes and throw him out onto the streets, that would be fun!!!

I was lucky enough not to have anything to do with this guy. I am surprised with those, who had so much trouble with him, though. If he sold my apartment or broke my mum’s hand I would spare some change and call the boys from the hood. They would have known what to do with him ;)

Hang the collector by the balls in the centre of the town, shove a pound or two of drawing pins and broken glass into his ass, but on the other hand he might enjoy that … and let him see what suffering is … the struggle continues….

Fill him with carbide and add some water. Oh, that would be so nice for him, damn bureaucrat. When he fills up with gasses, light him up. A nice effect, only shreds would remain. Still, it’s just wishful thinking, he can be seen no-where around the town. We can’t get him.

The comments were published mainly on the GazetaBytowska. pl (Bytów Newspaper) website, also accessible at gby.pl. The authorities (police and prosecutor) addressed Leszek Szymczak, the administrator of the website, and asked him to hand over particulars of the commentators. The authorities intended to charge those persons with punishable threats addressed at the collector. Leszek Szymczak did not, however, provide the data. The police called the comments “press material” and the Public Prosecutor’s Office in Bytów recognised that the administrator of the website was responsible for the comments published on the gby.pl forum. The Public Prosecutor’s Office also maintained that a website is a daily newspaper, by virtue of which under the press law it needed to be registered. Following the line of reasoning of the prosecutor, Leszek Szymczak ran the gby.pl website (i.e. he published a daily newspaper) without proper registration. The prosecution charged Mr Szymczak with the first accusation – the infringement of Article 45 of the Polish Act of 26 January 1984 on Press law2 – APL – (in Polish: ustawa Prawo prasowe), published in Journal of Laws (Dziennik Ustaw) No 5, item 24, with subsequent amendmets.

Anybody who publishes a daily newspaper or a periodical without registration or with registration suspended is subject to a fine penalty or the restriction of liberty

This was made in connection with article 7(2) pt. 2 of the APL.

A daily is a general-information periodical print or a message transmitted via sound or sound and image published more frequently than once a week.

The manner of registration of dailies and periodicals is provided in Article 20 of the APL.

1. Publishing a daily newspaper or a periodical necessitates registration with a voivodeship court having jurisdiction in the seat of the publisher, hereinafter referred to as ‘the registrar body’. In such cases the regulations of the Code of Civil Procedure on nonlitigious proceedings, together with amendments resulting herefrom, shall apply.
2. A registration application mentioned in section 1 hereof shall include:
1) the title of a daily newspaper or a periodical together with the seat and an exact address of the editorial office,
2) particulars of the editor-in-chief,
3) specification, seat and exact address of the publisher,
4) the daily newspaper’s or the periodical’s frequency of publishing.
3. A registrar court shall substantiate the decision to register a daily newspaper of a periodical only upon a motion.
4. A daily newspaper or a periodical can be published if a registrar body failed to decide upon the application for the registration within 30 days from the day of the submission of the application.
5. Should the information mentioned in section 2 hereof be altered, the registration body shall be immediately noticed.

The prosecution also alleged that Leszek Szymczak published press material featuring criminal content that publicly incited its readers to commit offences. For that reason the prosecution pressed the second charge. Under article 49a of the APL

An editor who unintentionally published press material that featured criminal content mentioned in article 37a hereof, shall be subject to a fine penalty or the restriction of liberty.

Under Article 255 of the Criminal Code3 – CRC – (in Polish: Kodeks Karny) of 6 June 1997, published in Journal of Laws (Dziennik Ustaw) No 88, item 553, with subsequent amendments

1. A person who publicly calls for committing an offence of a fiscal crime shall be subject to a fine penalty, the restriction of liberty or imprisonment for up to two years.
2. A person who publicly calls for committing a crime shall be subject to the restriction of liberty for up to three years.
3. A person who publicly praises the commitment of a crime shall be subject to a fine penalty amounting to up to 180 daily rates, the restriction of liberty or imprisonment for up to one year.

Article 37a of the APL reads

If a person is sentenced for a crime committed by publishing a press material, the court may adjudicate an additional penalty constituting in the forfeiture of the press material.

The prosecution maintained that Leszek Szymczak committed the crime of the nonfeasance of duties. The prosecution did not, however, establish what actually was meant by lynching, or at whom the comments were directed (the collector’s name was not even once mentioned on the gby.pl website).
It is noteworthy that Leszek Szymczak had registered a daily newspaper entitled Gazeta Bytowska when it was published in print4. In the period pointed at in the indictment, that is from April 13, 2004 to January 9, 2006, the court did not pass a decision that would make the registration invalid.

The Regional Court Słupsk in its judgment of 7 March 2007 case file II K 342/06 (with Judge Tadeusz Stodoła presiding) held that the first charge was legitimate, but owing to the minor social harm it remitted proceedings in the case. As for the second charge, the court held that posts of an internet forum indeed constitute press material and as such should be revised by editors and if they encounter inappropriate material, they should delete it. The court failed, however, to point to a specific law regulation that would necessitate Leszek Szymczak to delete any posts from his forum. Also this charge was dismissed. The court focused on the interpretation of the notion of “press material” and in this venture interpreted it correctly. The rub, though, remains in the fact that in this case the utmost importance should have been attached to the interpretation of the notions of a “daily newspaper” and a “periodical” since only those two kinds of press need to be registered with a court. Both parties appealed Leszek Szymczak appealed to overrule the judgment and dismiss the charge punishable under article 45 of the APL. He substantiated his appeal with, first of all, Article 17(1)2 of the Criminal Proceedings Code owing to the fact that under the law in effect publishers did not have to register websites in the register of daily newspapers and periodicals. Secondly, he also claimed that the regulations that impose such an obligation are too unclear to be a source of criminal liability according to the principle nulla poena sine lege certa et stricta (no punishment unless there is certain and strict law). Leszek Szymczak also appealed to change the sentence by acquitting the defendant from the offence provided in article 49a of the PLA owing to the fact that the defendant did not know about the illegal nature of the information (posts were uploaded/written by internauts) that the prosecution drew upon in the offence description. Because of that, his argument continued, the defendant could not be criminally liable, that is under Article 14(1) of the Polish Act of 18 July 2002 on Providing Services by Electronic Means – PSEM – (in Polish: ustwa o świadczeniu usług droga elektroniczną), published in Journal of Laws (Dziennik Ustaw) No. 144, item. 1204 with subsequent amendments, and Article 14 of the Directive 2000/31/EC6. Leszek Szymczak also appealed to completely overrule the abovementioned sentence and send the case back to the court of first instance for reconsideration.

The prosecution appealed against the judgment on the grounds of a mistake in factual findings that formed the basis for the judgment. It argued that the court was wrong to assess the social harm of the offence described in article 45 of the APL as minor (publishing an internet daily newspaper gby.pl without proper registration) and to discontinue proceedings with respect to this charge. Still further, a correct analysis of the subjective and objective features of the offence, particularly the legal interests undermined by the offence and the conduct of the defendant, all lead to other conclusions, the prosecution reasoned. The prosecution also maintained that the court made another mistake in the factual findings forming the basis for the decision. The court allegedly was wrong to assess the social harm of the offence described in article 49a of the APL as minor (unintentional publishing of press material with criminal content) and to discontinue proceedings with respect to this charge. A correct analysis of both subjective and objective features of the offence, including legal interests undermined by the offence and negative consequences experienced by the aggrieved party, especially in the party’s life and professional situation, the gravity and manner of the violation of obligations resting with the defendant, including the considerable time period of publication of the criminal content on the gazetabytowska.pl website and the conduct of the defendant after having acquainted himself with the content, all lead to the conclusion that social harm of the acts performed by the defendant cannot be described as minor, the reasoning continued.

The District Court in Słupsk asked the Prosecutor’s Office to delegate to the court the case of posts published on the website. The court observed that when the Prosecutor’s Office asked the administrator of the website to hand over information about the posts of possibly criminal nature, he indeed handed it over. Afterwards the Office discontinued the proceedings–having found no features of a prohibited act–but then pressed charges and indicted the editor.

The District Court in Słupsk in its judgment of 7 February 2008 case file VI Ka 409/07 held that managing an internet website necessitates registration. In consequence, running a website without registration violates the law. The court held that the reasoning of the Regional Court was correct and, similarly to the Regional Court, it discontinued the proceedings (at the same time ascertaining that the act had caused minor social harm). If it was not for that decision of the court, taking the face value of those sentences, anybody could be put on trial for running a website without registration. In this part the case ends with a discontinuance of the case for a year. The District Court in its decision on appeal made some controversial statements. In particular, the court decided that publishing information on the internet with the use of sound and image depends on the publisher, so any soundless publication still complies with the definition of a daily newspaper/a periodical. As concerns the second charge, the District Court overruled the former sentence and delegated the case for another hearing to the Regional Court. Following gby.pl, the court stated that a web portal, as a press title, needs to be registered: the District Court also suggested that

in a subsequent examination of the indictment, the Court should entertain upon sending case files back for pretrial proceedings due to its considerable shortcomings.

This might mean (the Regional Court still has to determine it) that the posted messages (posts) published on the forum might not have constituted an offence.

Discussion
If we go as far as to admit that in the light of the definition provided in Article 7(2) pt. 1 of the APL a website (such as gby.pl) is indeed “press”, considerable doubts still remain whether such a website is a “daily newspaper” or a “periodical”. Both definitions refer to the notion of “print” but also go further to encompass more media by providing that is might convey “sound or sound an image information”. Owing to the general lack of sound in internet websites, it is hard to deny that this regulation does not describe such a publishing medium. Article 7(2)(2) of the APL provides

1) press shall be defined as periodical publications that do not form a single and complete whole, are published at least once a year and bear a constant title or a name, a number and a date, in particular: daily newspapers and periodicals, news agencies bulletins, constant telex messages, bulletins, radio and television broadcasts, film chronicles; press shall also be understood as any and all existing and emerging in the course of technological advancement means of mass media, including broadcasting stations and television and radio broadcasting systems installed in facilities that distribute periodically publications via print, image, sound or any other broadcasting means; the press shall also encompass teams of people and individuals that deal with journalism,
2) a daily newspaper shall be a general-information periodical print or a sound or sound and vision message published more frequently than once a week,
3) a periodical shall be a periodical print published at least once a year but not more frequently than once a week; this regulation shall apply also to messages broadcast by means of sound or sound and vision and any other means than those described in section 2.

Similar Polish case law
Let us turn to Polish judicature concerning similar cases. The Appellate Court in Rzeszów ruled that an internet website cannot be recognised as a “daily newspaper” or a “periodical” as understood by the APL7. In another case, the Appellate Court in Warsaw recognised a teletext service not as a daily newspaper but as a text message as understood by article 4(9) of the Polish Act of 29 December 1992 on Broadcasting8 – LOB – (in Polish: Ustawa o radiofonii i telewizji), published in Journal of Law (Dziennik Ustaw) of 1993, No 7 item 34, consolidated text of 19 Novemver 2004, published in Journal of Laws (Dziennik Ustaw) No 253 item 2531, with subsequent amendments. The press law provides the definition of “press material”. Article 7(2)4 of the Act reads

press material shall be any informative, journalistic, documental or other text or image already published or provided to the publisher and intended for publication in press, irrespective of the means of transmission, type, form, destination or authorship of the material.

The decision of the Supreme Court the criminal Chamber of 28 September 20009 in the case of “traditional media” reads as follows

reader’s letters constitute press material as understood by Article 7 (2) 4 of the Act of 26 January 1984 on Press Law (Dz. U. 1984 No. 5 pt. 24 as amended) under the condition that the letters have been sent to the editorial office with the intention to be published. The editor-in-chief is responsible for their publication. A reader’s letter can be, therefore, published after the information contained in the letter has been cautiously and diligently verified as provided for by article 12 (1) of the Press Law. Publishing a reader’s letter does not constitute quotation of another individual’s statement. In view of that the editor-in-chief is still responsible for its publication.

The Supreme Court’s (Customs Chamber’s) decision of December 7, 199310 reads as follows:

Article 24 (1) together with article 23 of the Criminal Code and article 37 of the Press Law of 26 January 2984 provide the basis for a non-property claim of the violation of personal interests in a press material. The claim may be filed against a publisher.

The authors also need to mention that the Republic of Poland is a civil law country and there are no binding precedents. Also, the Supreme Court’s resolution is only binding for the court that referred with a specific question but in practice Polish courts often apply rules that were interpreted by the Supreme Court.

Different European jurisdictions
The decision11 of the Appellate Court in Berlin (Landgericht) of May 31, 2007 is an apt example of a similar case in German jurisdiction. The case revolved around the responsibility of a moderator of a website for posts made by third persons and the theory of the so-called “impartial internaut”. The court held that a moderator of an online portal is burdened with no general obligation to review (oversee) posts uploaded by third parties. The case involved a dispute between the administrator of the meinprof.de portal, a website used to evaluate professors of colleges and universities, and one of the evaluated professors who was dubbed on meinprof.de a “psycho” and “the bottom one”. Even though the moderator, having received a notice, did remove the posts, the professor filed a complaint with the court. The court held, however, that in this case the posts boiled down merely to airing one’s opinion. The justification of the ruling reads as follows

Under the press law, any publisher Verbreiter can be seen as an offender (Prinz/Peters, Medienrecht, 1999, Rn, 35). The publisher is anybody who, as in this case, contributes to the distribution of a statement. (BGH NJW 1986, 2503 (2504)–Ostkontakte).

Any third parties that (having been viewed objectively) by their actions support (financially) illegal actions that infringe legally protected interests cannot be liable for the infringement in civil cases. The condition for actual liability as an offender is the default of the obligation of review and control. The specific circumstances of a given case should decide if and to what extent the control is or might be compulsory. The decision should also depend on the determination of the function and tasks of the person charged with infringement and that person’s responsibility. The defendant, being an administrator of a platform for exchanging views, did not infringe the obligation of such review/control. Individuals who administrate online portals do not have to control all their content. Owing to the immense amount of content, such control would be unfeasible12.

Even the condition that in the rules of the website the defendant did reserve the right to delete illegal posts does not lead, contrarily to the assertions of the plaintiff, to the recognition of a general obligation to control content. Content control is obligatory only when a person, the personal interests of whom have been violated, brings an accusation in the form of a written notice. The notice should contain a detailed description of the violated personal interests with respect to a specific part of the content. In such a case the administrator of a portal does not have to conduct extensive searches at high personal and technological expense. The administrator will only have to check if the post that the accusation concerns can be described (from the perspective of an objective internaut) as conforming with the law. The defendant, dissimilarly to the administrator of a portal in the case decided upon by the BGH that the plaintiff evoked, did not violate the obligation of control. The administrator of the portal, upon the reception of a message from the plaintiff that centred upon the slanderous post, immediately deleted the post from the forum13.

No crime where there are doubts
In the Polish law, the regulations of the Act on Providing Services by Electronic Means, for example Article 14(1), provide that

A person who gives access to the contents of a network IT system to a customer, where the customer stores data, is not aware of the illegal features of the data or activity connected with the data and upon receiving an official notification or credible information about the illegal features of the data or activity connected with it, immediately bars access to the data, shall not be responsible for the data.

Chapter 3 of the PSEM, entitled “Exemption of responsibility of the service provider for providing E-services”, includes, as the title itself suggests, a number of other exemptions. The chapter concludes with a regulation in article 15 that reads

Any company that renders services described in article 12-14 shall not be required to verify the data described in article 12-14 that is transmitted, stored or made available by that company.

Having reviewed the above regulations, it seems there are two that actually collide with each other–one from the PL and the other from the PSEM. The modus operandi should be drawn entirely from provisions of the law. Having determined it, only now can we turn to the analysis of regulations such as, for example, article 25(4) of the APL, which reads

The editor-in-chief shall bear the responsibility for the content of the material prepared by the editorial team and the organizational and financial issues of the company within the frames set up in the articles of association or relevant regulations. The editor-in-chief is also responsible for safeguarding linguistic correctness of press materials and counteracting their vulgarization.

Another article of the APL, already mentioned above, article 54b (included in Chapter 8, “Proceedings in press cases”) reads

Provisions on legal responsibility and proceedings in press cases shall be applied to the infringement of law connected with the transmission of human thought via means designed to distribute information, irrespectively of the technology of transmission, especially nonperiodical publications and other print, vision and sound products, other that press.

All criminal cases should be decided on in the scope of the principle nullum crimen sine lege (no crime without a law). The aforementioned cases are indeed riddled with doubts. The authors can hardly adhere to the claim that this clause might mean legal liability for the lack of registration of press other than a “daily newspaper” or a “periodical”, also because of the fact that the regulation covers mass media other than the press. In the authors’ opinion, the gby.pl website can be recognised as “press” but is neither a “daily newspaper” nor a “periodical”.

The legal basis is Article 414 of the Criminal Proceedings Code.

1. After the court proceedings have been instigated, if circumstances precluding prosecution or information substantiating conditional discontinuance of the proceedings are recognized, the court may decide to discontinue the proceedings or discontinue the proceedings conditionally. However, if circumstances provided in article 17(1) 1 and 2 are recognized, the court may issue an acquitting judgement, unless the offender at the time of the offence was non compos mentis

and article 66 (with subsequent ones) of the Criminal Code

The court may conditionally discontinue penal proceedings if the guilt and social harm of the illegal act are nor considerable, circumstances of the act are doubtless and the attitude of the offender that has not been punished for an intentional crime, the offender’s personal conditions and former lifestyle substantiate the speculation that the offender will obey the rule of law and especially that will not commit another crime…

Conclusion
Since the gby.pl is neither a daily newspaper nor a periodical, by discontinuing the proceedings in the case the courts apparently did not recognise that “the act was not committed or there was a lack of information sufficiently substantiating the suspicion of its committal” or that “the act did not bear the features of an illegal act or the law provided that the offender did not commit a crime”.

The Polish Act on Providing Services by Electronic Means was to implement into the Polish legislation the European Parliament and Council Directive 2000/31 of June 8, 2000 on certain legal aspects of information society services, in particular electronic commerce, in the internal market (Directive on electronic commerce) and the European Parliament and Council Directive 2002/58 concerning the processing of personal data and the protection of privacy in the electronic communications sector (Directive on privacy and electronic communications)14. The way Poland incorporated those two Directives into a single domestic legal act stirred considerable criticism15.

Many individuals pointed out that the implementation of the Directives boiled down mainly to the literal translation of their content into Polish, which was then put into a single legal act. In consequence, the Act draws on inconsistent terminology, for instance in some of the regulations the Polish Act uses the term “an information recipient” and in others “a service recipient”. Another problematic issue is the fact that the Act refers to other regulations provided in other domestic legal acts (e.g. the Telecommunications Law Act of 21 July 200016). What is even more, the regulations of the Polish Act do not explicitly set out if a service provider is exempt from civil liability or also criminal liability resulting from rendering e-services. Even further, the European Council reminded Poland that it had implemented the Directive 2000/31 only partially17. As a result, Poland initiated another legislative process that aimed at full implementation of the Directive, especially with regard to the implementation of the “country of origin” rule and the rule of the freedom of providing e-services.

Apart from the imprecise PSEM and the 1984 Press Law Act, which is a legal act originating practically in another era18, the only legal act that directly refers to internet publications is the Access to Public Information Act of September 6, 2001. The Act introduced an “official teleinformation publishing system” in the form of a “unified webpage system” (article 8). The only Polish legal act that suggests how to create websites (for public institutions to comply with the obligation to publish public information) is the Minister’s of Interior and Administration Regulation of January 18, 2007 on the Public Information Bulletin (BIP). Under article 9(2) of the Regulation

Where a subject, referred to in article 4(1) and (2) of the Act, owns an internet website, the subject’s own BIP website shall be created as a part of the website by placing a link with the BIP logotype that shall give direct access to the subject’s BIP website.

Apart from the imprecise definition of the Public Information Bulletin, which functions on the basis of the aforementioned Access to Public Information Act, there can also be the socalled “own website” which, even though provided for in the Regulation, is not defined therein. In consequence, while creating websites, public administration bodies are bound by no other rules than those existing in the “outer world”. Having recognised that, the authors put forward a statement that since in Leszek Szymczak’s case the charges (publishing a periodical without a registration) were not dropped owing to the lack of features of a prohibited act, the same charges (publication of internet websites without proper registration) can be brought against the highest public institutions in Poland. The authors asked the Chief Police Officer on May 8, 2007 the following: do these “own” internet websites (of public institutions) exist legally? The answer was that the Polish police does not register their internet websites with a registration court.

In a democratic country observing the rule of law, the situation of a public institution, which under Article 7 of the Polish Constitution “functions on the basis and within the limits of the law”, differs from the situation of a subject functioning on the basis of economic freedom. Apart from publishing a BIP bulletin, Polish public institutions can also publish daily newspapers and periodicals (which is allowed under article 8 of the APIA)

The publisher can be a legal entity, a natural person or a different organizational entity, even if it is not a legal entity. In particular a publisher can be a public institution, a staterun company, a political organization, a labour union, a cooperative, a selfgovernment body and other social organization, a church or any other religious organization.

If this is the case, public administration institutions should also fulfil legal conditions on the publication of such a newspaper or a periodical. The current practice shows, nevertheless, that the public administration massively creates internet websites and does not register it with registration courts. The Chief Officer of the Police answered the authors19.

The Act of 28 January 1984, the Press Law, does not recognize internet websites as daily newspapers or periodicals.

The first President of the Supreme Court, Lech Gordocki, made a similar statement, later published in the press20.

I am not going to apply to the Regional Court for the registration of the website of the Supreme Court since the Act does not provide such an obligation.

Neither the President of the Republic of Poland, nor the Commissioner for Civil Rights Protection, the Prime Minister of Poland and none of the Polish ministries and state agencies registered their own websites, which functionally do not differ from news websites. Then, if a court held that an individual who published a periodical without proper registration brought minor social harm, the court could rule otherwise if the charged entities were the police, the Prosecutor’s Office, the Ombudsman or even the President, who apart from BIP bulletins all publish news websites without registering them with registration courts21.

As already mentioned, the only normative suggestion concerning internet websites in Poland comes in the form of executive regulations relating to the Access to Public Information Act. These regulations do not differentiate between “websites”, “portals”, “vortals”, etc. Generally we do not know what a “portal”, a “vortal” or a “blog” are. However, Polish courts pass judgments in which judges try wrongly to differentiate between those terms22. If there is no difference between publishing a periodical necessitating proper registration and publishing a blog, then perhaps we should also scrutinise the publishing activities of Marek Siwiec, a Vice-President of the European Parliament, who has been publishing his ruminations at http://mareksiwiec.blog.onet.pl also without registration with a registration court since 2007.

Recent press releases in Poland induced several individuals to apply to registration courts for the registration of blogs as daily newspapers and periodicals (as understood by the Polish Press Law). In some of those applications courts decided to enter names of the blogs to the Register of Daily Newspapers and Periodicals. This, however, under the Polish law, does not mean that in Poland you need to register a blog with a registration court. First of all, such an application should be filed before publishing has started, but that, again, makes it impossible for a court to decide if a given activity necessitates registration. Secondly, courts cannot deny registration if an individual or an organisation files for the registration of something that is neither a daily newspaper nor a periodical. Under article 21 of the APL

A registrar body shall deny the registration if:
[1] the application does not contain data that the Act describes (the daily newspaper’s or the periodical’s title, the seat of the publisher and the exact address of the editorial office, the particulars of the editor-in-chief, the particulars of the publisher, the frequency of publishing of the daily newspaper or the periodical) and

[2] if granting registration would constitute infringement of the right to the legal protection of an existing press title.

Owing to the above, Polish registration courts did enter the names of blogs provided by their applicants23.

In the case of Leszek Szymczak, the defence asked the Polish Commissioner for Civil Rights Protection to apply for a revocation of the sentence (it can be applied for only by the Commissioner and the Prosecutor General). By the end of June 2008 the defence also filed a constitutional complaint (see the website of the Helsinki Foundation for Human Rights24).

P.S.
The Regional Court in Słupsk in its judgment of 16 December 2008 acquitted Leszek Szymczak from charges of publishing press material featuring criminal content that publicly incited its readers to commit offences. See “Press law, case II K 367/08“.

Footnotes
1. Case file VI Ka 409/7.
2. Journal of Laws (Dziennik Ustaw) No.5, pos. 24, with subsequent changes.
3. Journal of Laws (Dziennik Ustaw) No.88, pos. 553, with subsequent changes.
4. On the basis of the decision of the Voivodeship Court in Slupsk Ns-Rej.Pr 8/91 of September 12, 1991.
5. Ustawa z dnia 18 lipca 2002 r. o świadczeniu usług droga elektroniczna, Journal of Laws (Dziennik Ustaw) of September 9, 2002, No.144, pos.1204, with subsequent amendments.
6. Directive 2000/31 of the European Parliament and of the Council of June 8, 2000 on certain legal aspects of information society services, in particular electronic commerce, in the Internal Market (Directive on electronic commerce) [2000] OJ L178/1-16.
7. Case file I ACa 277/05.
8. Case file I ACa 601/98. Broadcasting Act, Ustawa z dnia 29 grudnia 1992 r. o radiofonii i telewizji, Journal of Laws (Dziennik Ustaw) of 2004, No. 253 item 2531.
9. Case file V KKN 171/98.
10. Case file III CZP 160/93.
11. Az. 27 S 2/07.
12. Decision of December 7, 2006, Az. 10 W 106/06; BGH NJW 2004, 3102.
13. J. Kurek, Comment available at http://prawo.vagla.pl/node/7341#comment-4526 [Accessed November 10, 2008].
14. [2002] OJ L 201/37-47.
15. G. Raczka, Ochrona Uslugobiorcy uslug elektronicznych (Torun 2007), p. 63, W. Iszkowski, X. Konraski, “Elektroniczne uslugi”, Rzeczpospolita newspaper, March 4, 2003.
16. Journal of Laws (Dziennik Ustaw) of 2001, no.73, pos. 852, as amended.
17. Commission of the European Communities, First Report on the application of Directive 2000/31 of the European Parliament and of the Council of June 8, 2000 on certain legal aspects of information society services, in particular electronic commerce, in the Internal Market (Directive on electronic commerce), Brussels, November 21, 2003, COM(2003) 702 final, p. 19.
18. It is noteworthy that August 17, 1991 is a symbolic date recognised as the inception of the Polish internet, i.e. the first time when via an IP protocol the Physics Department of the Warsaw University sent data to the Computer Centre of the Copenhagen University.
19 Letter of June 19, 2007 regarding the answer of the spokesman of the Chief Officer of the Police concerning websites run by the police. See http:// prawo.vagla.pl/node/7329 [Accessed November 10, 2008].
20. In a Polish daily newspaper, Rzeczpospolita, on September 6, 2007.
21. See http://www.president.pl, http://www.kprm.gov.pl/english, http:// www.rpo.gov.pl/index.php?s=3 [Accessed November 10, 2008].
22. See Judgment the district court in Warsaw (IV Civil Division) of June 9, 2008, case file Act IV C 806/07.
23. See http://olgierd.bblog.pl/wpis,moj;nowy;organ;prasowy,7042.html [Accessed November 10, 2008].
24. See http://www.hfhrpol.waw.pl/precedens/pl/aktualnosci/sprawa-gazety-bytowskiej-w-tk.html [Accessed November 10, 2008].

This article was originally published under the title Polish Courts Say Websites Should Be Registered As Press in the Computer and Telecommunications Law Review, C.T.L.R. 2009, 15(1), 9-14.

E-commerce law, case C-298/07

October 20th, 2008, Tomasz Rychlicki

The Court of Justice of European Communities in its judgment of 16 October 2008 in case C-298/07, deutsche internet versicherung, held that Article 5(1)(c) of the Directive 2000/31/EC of the European Parliament and of the Council of 8 June 2000 on certain legal aspects of information society services, in particular electronic commerce, in the internal market (‘Directive on electronic commerce’) must be interpreted as meaning that a service provider is required to supply to recipients of the service, before the conclusion of a contract with them, in addition to its electronic mail address, other information which allows the service provider to be contacted rapidly and communicated with in a direct and effective manner. That information does not necessarily have to be a telephone number. That information may be in the form of an electronic enquiry template through which the recipients of the service can contact the service provider via the internet, to whom the service provider replies by electronic mail except in situations where a recipient of the service, who, after contacting the service provider electronically, finds himself without access to the electronic network, requests the latter to provide access to another, non-electronic, means of communication.

Computer crimes, case VI K 849/07

October 6th, 2008, Tomasz Rychlicki

On August 11, 2008, the District Court in Glogów (VI Wydzial Grodzki) issued an important ruling case file VI K 849/07, regarding a man accused by the prosecutor of using computers to breach electronic security of a company server and database which allowed him to obtain information not intended for him (personal data) thereby acting to the detriment of the business. Mateusz M. was accused by the prosecutor based on regulations provided in Artice 267 §1 of the Polish Penal Code.

Chapter XXXIII. Crimes against protection of information
(…)
Article 267.
§ 1. Whoever, without being authorised to do so, acquires information not destined for him, by opening a sealed letter, or connecting to a wire that transmits information or by breaching electronic, magnetic or other special protection for that information shall be subject to a fine, the penalty of restriction of liberty or the penalty of deprivation of liberty for up to 2 years.
§ 2. The same punishment shall be imposed on anyone, who, in order to acquire information to which he is not authorised to access, installs or uses tapping, visual detection or other special equipment.
§ 3. The same punishment shall be imposed on anyone, who imparts to another person the information obtained in the manner specified in § 1 or 2 discloses to another person.
§ 4. The prosecution of the offence specified in § 1 – 3 shall occur on a motion of the injured person.

Mateusz M. had browsed through an internet company website and found that the service contained serious programming errors. He put into the login form a string of signs as follows “‘ or 1 = 1” (and repeated this operation in the password field), which resulted in him being signed/logged into a random user account which allowed him to gain access to several user accounts and their personal data. Mateusz M. decided to exploit this opportunity and made contact with company’s representatives. He informed them that he detected a gap in their website security which allowed him entry to the marketing database of firms owned or connected with the company which operated this online database. In the meantime, Mateusz M. checked other websites and online services created by the same authors of the first website. He has also found that all of them contained the same programming errors because all these websites were built using the same content management system (CMS). Mateusz M. was invited by the company to sign a contract to remove these programming errors. He was also presented with a non-disclosure agreement (NDA), which he signed. However the NDA’s date was set prior to the date he had detected the programming errors and this was used by the company to enable the police, who were co-operating with the company, to arrest Mateusz M.

During the pre-trial proceedings the court’s expert in the field of information technology stated that in his opinion Mateusz M. had used “a form of attack on the company’s database called SQL Injection”; the aim of such an attack is “to extract confidential information from the database and to disrupt its operation”. In the course of the proceedings before the court, the District Court in G#x142og1ow allowed the counsel for the defence to admit evidence of another expert.

The second expert provided the court with an opinion that by introducing a string “‘ or 1 = 1” Mateusz M. had not made any breach of the database, he did not crack any password allowing for access to the database, he did not type or insert any software code and Mateusz M. had not affected the functioning of the database in any way. According to the second expert, Mateusz M. had not removed the database security, and he had not changed the password access, nor did he create any new accounts in the database. In this expert’s opinion, the introduction of the said string by Mateusz M. should be considered as an “SQL Injection” method that was used to circumvent the protection of a database, but that it was permitted by the improper and inadequate protection scheme applied to the database by its creators. The “Sign in” form of the database was designed in such a way that merely typing any string of characters was permitted as an input of data for this type of form. The database authors had not implemented any solutions to verify whether the database stored a user name or password attached to such a string, and as it had not, the database did not generate a proper error message

The court held that the action of the accused failed to comply with the statutory elements of Article 267. In the court’s opinion, breaching security occurs when the offender destroys or removes the security, or when the impact of the offender’s action on the security temporarily removes its protective function. Thus a person who gains access to sensitive information without breaking any security measures is not criminally responsible.

The court ruling acquitted the accused of all the charges based on art.632(2) Polish Criminal Proceedings Code, and the court held that the costs of wrongful prosecution were to be covered by the state. This decision was final and consequently there are pending amendments to the Polish Criminal Code relating to the aforementioned regulations.

Trade mark law, e-filing for trade marks applications

April 28th, 2008, Tomasz Rychlicki

There are recent changes in the procedure of filing trade mark applications before the Polish Patent Office. According to the Regulation of the Prime Minister dated 15 May 2008 on filing and processing of patent applications, applications for medicinal products and plant protection products, utility model applications, industrial designs applications, trade mark applications, geographical indications applications, topography of integrated circuits applications and keeping correspondence in electronic form, published in Journal of Laws (Dziennik Ustaw) of 23 May 2008, No 89 item 540, all applications should be filed in e-forms that are available through the PPO website and are prepared in software and in compatibility with formats used by the Polish Patent Office. The use of other computer programs to prepare filing applications requires the approval of the PPO. This Regulation will enter into force on 7 June 2008.

The PPO had also published (DOC file) an English version of table of fees established in the Regulation of the Council of Ministries dated 26 February 2008 amending the regulation on fees relating to the protection of inventions, utility models, industrial designs, trademarks, geographical indications and topographies of integrated circuits.

Single fees (fees are in Polish złoty – to check rates use google.com services or exchange rates provided by the National Bank of Poland):

  • For trademark application up to three classes of goods according to applicable classification of goods and services – 550,00*
    for each class in excess of three – 120,00
    for declaration of priority – for each priority claimed – 100,00
  • For electronic filing of trademark application up to three classes of goods according to applicable classification of goods and services – 500,00*
    for each class in excess of three – 120,00
    for declaration of priority – for each priority claimed – 100,00
  • For request for conversion of international registration into national application – 550,00
  • For request for conversion of Community trademark application into national application – 550,00
  • For transmittal of Community trademark application – 120,00
  • For division of application – for each additional application – 550,00
  • For request for postponement of the payment of a fee – 60,00
  • For request for restoration of a time limit or the excuse of non-observance of a time limit because of exceptional circumstances occurred – 80,00
  • For request for re-examination of the matter:
    in connection with an order issued** – 50,00
    in connection with a decision taken – 100,00
  • For publication of the mention of grant of right of protection – 90,00
  • For issuance of a duplicate of certificate of protection: – 100,00
  • For excerpt from the register: with current legal status with modified or removed information added – 60,00
    100,00
  • For preparation of priority document – 60,00
  • For request for making a change in the register – for each change made – 70,00
  • For request for replacement of national registration with international registration – 50,00
  • For request for transformation of trademark into collective trademark, collective guarantee trademark or trademark protected with one collective right of protection – 500,00
  • For request for filing a request by the Patent Office of the Republic of Poland for entry in the international register of a change concerning international trademark registration – 200,00
  • For notice of opposition 1000,00
  • For request for taking a decision in litigation proceedings – 1000,00
  • For request for lodging a complaint to Administration Court – 1000,00
  • For request for international registration – 600,00
  • For request for registration renewal – 200,00
  • Additional fee for late submission of request for registration renewal – 300,00
  • For request for sending communications to addresses additionally indicated (Article 241(2)) – for each additional address – 200,00

* In case of collective trademark, collective guarantee trademark or trademark filed for collective right of protection – the amount of the fee is subject of increase of 100%
** this does not apply to requests for the exemption from the payment of a fee

See also “Poland: higher fees for trade marks“.

Access to public information, case V Ca 454/07

July 30th, 2007, Tomasz Rychlicki

Sergiusz Pawłowicz who was also the leading programmer of Janosik project, went the same administrative proceedings as the ISOC Poland. See “Access to public information, case OSK 600/04“. At the final stage the Supreme Administrative Court dismissed Sergiusz’s complaint on the decision of the Voivodeship Administrative Court case file II SAB/Wr 72/02, recognizing that the proper course shall be a civil action.

Sergiusz filed a complaint requesting the civil court to order ZUS to disclose specification of KSI MAIL protocol being public information. The Regional Court in Warszawa in its judgment of 8 December 2006 case file XVI C942/04 ruled that publication of the protocol that is used by Płatnik software will not affect in any way the integrity of safety of data sent by this software. Therefore all arguments raised by ZUS with regard to data security were unfounded. The Court also held that ZUS did not prove that the protocol of KSI MAIL is protected by copyrights that belongs to Prokom Software S.A. or whether Prokom received any patent covering this protocol. As for the argument that ZUS’s obligations regarding confidentiality of information about technologies used in Płatnik and its source code, which resulted from the agreement between ZUS and Prokom, the court held that according to the obligation to disclose public information as provided in the Article 13 of the Polish Act of 17 February 2005 on the Informatization of Entities Performing Public Tasks – IEPPT – (in Polish: ustawa o informatyzacji działalności podmiotów realizujących zadania publiczne), published in Journal of Laws (Dziennik Ustaw) No 64, item 565 as amended, the provision of the agreement as a ius dispositivum, may not impose negative consequences on Sergiusz. The court also held that the use of the requested public information and legal interest that Sergiusz and its legal representative derrived from the social interest was beyond the scope of the whole dispute. Simply, there is no need to prove legal interest when requesting the access to public information.

ZUS filed an appeal complaint. The Appellate Court in Warsaw in its judgment of 23 April 2007 case file V Ca 454/07 dismissed it. The Court held that the court of first instance provided deep and proper analysis of binding legal norms and its judgment was correctly applied.

Copyright law, case VI ACa 1012/2005

April 22nd, 2007, Tomasz Rychlicki

The Appellate Court in Warsaw in its judgment of 14 March 2006, case file VI ACa 1012/05, published in the Jurisprudence of Appellate Courts (in Polish: Orzecznictwo Sądów Apelacyjnych) of 2007, No 12, item 36, p. 56, held that when it comes the legal protection of the author’s work it does not matter how the infringer came into the possession of the work, or how the work arrived to him, in particular, it does not matter that the work, which is the subject of the infringement came to the infringer as unsolicited correspondence sent electronically, the so-called spam. The protection is not only afforded to the well known creator, whose works are published in big numbers, but to anyone whose rights to a protected work have been infringed in any possible way, copyright law makes no distinctions in the field of protection depending on the value of the work and the recognition enjoyed by the author.

See also “Polish regulations on copyright” and “Polish case law on copyright“.