Expectations for Polish TMT in 2023

It can be stated with confidence that 2023 will be a year in which a lot will happen in the areas of telecommunications, media, and technology. For Poland, 2023 will be the year in which it will have to fully absorb that the biggest war in Europe since 1945 is taking place in a neighbouring state – Ukraine – and that it has again became a country on the front line with an increased risk of cyber-attacks to its infrastructure and businesses. It will also be necessary to cope with the increasing costs of energy and the potential interruption of supply. Energy-intensive technologies (including large cloud centres) will have to think about the solutions to limit their electricity consumption and ensure a continuous provision of services. Combined with growing awareness about climate change and initiatives to reduce CO₂ emissions at the EU level, this may trigger substantial innovation and developments in energy generation and consumption in these sectors.

On top of that, 2023 will be a very active year for legislators and regulators. On the EU level, a number of new legal acts have already been adopted (eg, the Data Market and Data Services Acts) or are expected (eg, the Data Act, the EU Health Data Space and the AI Act). In addition, Polish legislators will be busy in 2023 as, finally, the new Electronic Communication Law has reached the Polish Parliament and is expected to enter into force in the third quarter of 2023.

Often criticised for their insufficient protection of consumers and smaller market players, Polish regulators have started to take a more active stance. The Polish data protection authority has just announced that, in 2023, it will carry out inspections of entities running mobile and web applications. This article goes into greater detail on the approach of Polish regulators concerning influencers and the enforcement of EU legislation.

The Growing Importance of Cybersecurity

The growing cybersecurity threat has triggered legislative activity, including the EU NIS 2 Directive, which came into force on 16 January 2023. For Poland, this means that the National Cybersecurity System Act (the “Polish Cyber Act”) will have to be amended by 17 October 2024 at the latest.

NIS 2 Directive

The NIS 2 Directive is designed to make cybersecurity and response capabilities to various types of incidents in both the public and private sectors even stronger. The most significant change comes down to the expansion of the scope of obliged entities and their division into “essential entities” and “important entities”. In addition to those in the energy, transportation, banking, financial and health sectors, the essential entities will include:

• cloud computing service providers;
• data centres service providers; and
• content delivery network providers.

Among the categories of “important entities”, a new group has emerged: providers of social networking services and courier service providers. The obliged entities will be required to prepare and implement appropriate procedures for cybersecurity and the reporting of breaches, incidents, and cyberthreats. Under NIS 2, the Cyber Crisis Liaison Organisation Network (EU-CyCLONE) will also be established to support the co-ordinated management of large-scale cyber-attacks and crises.

The Polish approach to cyber-security

In Poland, the National Cybersecurity System aims to ensure cybersecurity at the national level, in particular, the uninterrupted provision of essential services and digital services, and the achievement of a sufficiently high level of security of the ICT systems used to provide these services. Poland has been working on an amendment to the Polish Cyber Act since September 2020. Subsequent versions of the bill have raised numerous controversies over the new obligations of participants in the national cybersecurity system; this raises significant costs for entrepreneurs. To avoid double standards, as a result of any differences between the Polish Cyber Act and NIS 2, legislators should focus on implementing the NIS 2 Directive and not on the previously proposed amendments.

Cyber-resistance of the internet of things

Complementary to the NIS 2 Directive and wider activities ensuring the security of critical supply chains is the Cyber Resilience Act (CRA), which covers the security of internet-connected devices – especially the internet of things (IoT). The CRA is intended to establish common standards for software and digital equipment manufacturers, in particular, by ensuring that:

• for the expected lifetime of the product or for five years after launch, cyber vulnerabilities are effectively addressed;
• there will be the obligation to notify the EU Agency for Cybersecurity of identified vulnerabilities in a product or service within 24 hours; and
• manufacturers of electronic equipment take into account cybersecurity principles from the design stage of their goods and services.

In Poland, the CRA bill has gone through the public consultation stage.

Cybersecurity as a service – an increasingly attractive solution

Cybersecurity as a Service (CSaaS) is an outsourced model of cybersecurity management. Due to the growing number of cyber-attacks, the awareness of Polish companies in this area is increasing. Due to a lack of in-house dedicated cybersecurity specialists, companies are turning more and more to outsourced cybersecurity services. This is, in turn, driving the emergence of companies providing cybersecurity services on the Polish market.

Increased Focus on the Consumer in E-commerce and Media Activities

On 1 January 2023, three EU directives – the DCD Directive, the SGD Directive, and the Omnibus Directive – were implemented into the Polish legal system. These rules impose new obligations on entrepreneurs entering into contracts with consumers and aim to increase digital consumer protection, primarily in the face of unscrupulous marketing practices of entrepreneurs.

After Poland’s significant delay in implementing these directives, Polish consumers will finally get the protection consumers in other EU member states already enjoy. This marks a major change for Polish e-commerce firms, which should reorganise their online operations.

Is this the end of Black Monday, Black Friday, and Black Weeks?

The new regulations are aimed at increasing consumer protection while shopping, and eliminating entrepreneurs’ illegal practices. The most important is the requirement of transparent information on discounts (an entrepreneur announcing a promotion or sale will have to provide, in addition to the current price, the lowest price offered in the 30 days preceding the reduction), clear rules for placing offers in online search results, and a prohibition on suggesting that published consumer opinions are genuine if the entrepreneur has failed to introduce mechanisms to ensure their trustworthiness. The regulations impose new information obligations on entrepreneurs operating online (eg, stating if published opinions are verified and in what manner), and on shopping platforms (eg, indicating whether a given offer originates with a business or a natural person). In the coming year, it will become clear how these new regulations have affected the market and the promotions offered by entrepreneurs.

The consumer can do more

As of 2023, a consumer will be able to take advantage of the warranty concerning the “non-conformity of goods with the contract”, rather than the “occurrence of a physical or legal defect in the goods”, as before. What is more, concerning the non-conformity of goods with the contract, the consumer will have to demand the repair or replacement of the defective goods first, and only later a price reduction or withdrawal from the contract (the hierarchy of claims). The entrepreneur will also have a shorter time to process a consumer’s complaint (the time has been reduced from 30 days to 14 days), and the consumer will have a longer time to file a complaint (the time has been extended from one to two years from the delivery of the product). The period of the seller’s liability remains unchanged and is still two years from the date of the delivery of the goods.

Digital revolution

Many changes also await the Polish market in the digital world, including a complete novelty in the regulations – ie, the appearance of a category of goods with digital elements (“smart” goods). Goods with digital elements, digital content, and digital services can be complained about in the same manner as any other goods or services. The entrepreneur will be responsible for the compliance of such digital goods (eg, games and computer programs) with their trial versions or announcements. They will also be obliged to provide consumers with updates for at least two years. Consumers will be protected not only if they pay for digital content or services with money (eg, access to applications) but also with their personal data (eg, the right to withdraw from the contract within 14 days).

Social commerce - influencers under the regulator’s magnifying glass

Many consumers make purchasing decisions while browsing social media or buy a product directly through Facebook, Instagram, or Tik Tok. The reason for this is that many influencers promote services or products on behalf of advertisers on their social media accounts, doing so in a way that gives the impression that they are providing their own honest opinion, not that the influencer is influenced by their advertising contract. Thus, without being aware that the influencer’s statement is an advertisement, consumers willingly opt for the goods or services they recommend.

Currently, there are no regulations that directly govern how to tag advertising material on social media. Nevertheless, the law clearly states that advertising content must not mislead consumers. To protect consumers, the Polish President of the Office of Competition and Consumer Protection (OCCP) announced the “Recommendations pertaining to the tagging of advertising content by influencers on social media.” Despite their lack of legal force, these Recommendations are another step in the fight against unfair market practices in social media, and will certainly contribute to increased legal awareness among influencers, to the benefit of consumers.

According to the Recommendations, an influencer should tag advertising materials published on their social media channels in a way that is clear, unambiguous, and understandable for every recipient. Among other things, such tags must be placed in a prominent place (and not, for example, only after the user expands the description of the post), written in a clear font that is not too small, and not merge with the colour of the background. Two-level tagging is recommended; namely, using both the platform’s functionality and single tagging (eg, in the description, in a photo or video, or in the narration of the material). The OCCP also recommends using specific words to designate advertising material. The method of concluding a contract between an influencer and advertising agency or an advertiser and a form of compensation (eg, cash, products or services, discounts on the purchase of products or services) is not relevant when it comes to recognising the content as commercial. Self-promotion also must be tagged as an advertisement.

The OCCP’s actions as regards an influencer’s marketing on social media have initiated positive changes in the proper labelling of commercial content. The next step is to verify the labelling of content published on websites. However, this appears to be only the beginning of the OCCP’s activities in this area as it has announced that all possible steps will be taken to ensure that internet users are protected from hidden advertising and have the opportunity to make a conscious choice about whether they want to read commercial content.

The New Electronic Communications Law is finally coming

A major change, not only for telecommunications industry entities, will be the entry into force of the new Electronic Communications Law (ECL) and the Law Introducing the Electronic Communications Law. Without a doubt, this will be one of the most important legislative events in the TMT area in Poland in 2023. The ECL is an implementation of the European Electronic Communications Code (Directive (EU) 2018/1972 of 11 December 2018) and is to fully replace the existing act of 16 January 2004 (the “Telecommunications Law”). The scope of the ECL is much broader than that of the Telecommunications Law as it will comprehensively regulate the market for electronic communications services. The new regulations apply not only to the traditional telecommunications services sector, but also to interpersonal communication services not using numbers. This mainly involves instant messaging services (eg, Messenger or WhatsApp) as well as email. The planned changes will also cover the rules for the provision of electronic services (sending unsolicited marketing information), direct marketing (cookies), or processing the personal data of electronic communications services users. As of now (the second half of January 2023), the draft ECL is being debated by Parliament. It is expected it will enter into force in the third quarter of 2023 (six months after its official publication). The ECL and the implementing act will amend more than 50 Polish legal acts.

New powers for law enforcement agencies

One of the most widely discussed proposals consists of obliging instant messaging providers (eg, Messenger or WhatsApp) to store their users’ data to the same extent that telecommunications entrepreneurs are currently required to store such data (eg, the place and time of login). Under the new regulations, instant messaging providers will be required to store data “clearly identifying a user of the network” for 12 months. In practice, this may be all the data that the provider of a particular service has collected on a user. Also, the providers would have to make available traffic data (including real-time location data of users) and, most likely, the content of the communication, upon request of law enforcement authorities without any involvement of the providers’ personnel. If the provider does not comply with this obligation, it may be banned from the Polish internet. There is a common opinion that such broad rights being given to law enforcement agencies is incompatible with EU law (including the EU Charter of Fundamental Rights).

Direct marketing - will the previous consents be valid?

Consent to online or phone marketing collected by data controllers under the existing regulations will remain in force if the original method of expressing consent meets the conditions stated in the ECL. The companies will have to verify the consents on which they rely and decide whether it will be necessary to collect them once more.

Guidelines for direct billing

Direct billing – ie, fees for services which are added to telecommunications bills (eg, for subscriptions to VOD platforms) – will be regulated. This applies to both one-time charges (eg, renting a movie from a VOD library) and recurring charges (subscription). The service is to be available to users with their prior consent “on a durable medium.” This is supposed to further protect consumers from “unknowingly” launching a particular service. It is also proposes introducing a limit (PLN35 per month), above which additional services can no longer be added to the bill.

Must carry/ must offer

A lot of controversy surrounds the bill introducing the ECL, in particular, changes to the “must carry must offer” (MCMO) obligation, which is currently regulated under the Broadcasting Law. The MCMO obligation is the requirement put on certain broadcasters to make their channels available (must offer) to operators that distribute TV channels. The operators, in turn, have an obligation (must carry) to distribute these channels or pay a fine.

The proposed amendments are to change the scope of the channels covered by the MCMO, excluding privately owned channels and limiting them only to the channels of the public broadcaster, owned by the Polish State. In addition, the Chairman of the National Broadcasting Council is to be given very broad powers to determine the list of additional channels covered by the MCMO. These changes are the subject of heated discussion, including on the grounds of incompatibility with EU law and the Polish Constitution.

New Liability Rules for Online Content-Sharing Service Providers

Another important legislative development in 2023 will be the implementation of the Copyright Directive (Directive (EU) 2017/790 of 17 April 2019) on copyright and related rights in the Digital Single Market. In Poland, this amendment has been widely commented on, among other things, due to the content of Article 17 – ie, the use of protected content by online content-sharing service providers. The mentioned article was challenged before the CJEU by Poland and several other member states. The new legislation was referred to in the media as “ACTA 2”.

The implementation of the Copyright Directive will take place in Poland by amendment to the Act of 4 February 1994 on Copyright and Related Rights. The bill also introduces new rules for the liability of online content-sharing service providers – ie, administrators of web pages on which users can publish content (eg, photos, videos or text). Under the new rules, platform providers will be liable for copyright infringement regarding the content distributed by their users unless they meet conditions exempting them from such liability.

How will the new liability rules work?

The new regulations indicate that, as a general rule, a provider may distribute content uploaded by its users if the right-holder allows it. If such consent has not been obtained, indemnification from liability for the unlawful dissemination of content is possible, but more difficult, as a provider of online content services will be required to demonstrate that:

• it exercised due diligence to obtain the consent of the right-holder;
• it exercised due diligence in accordance with high standards of professional diligence in the sector to prevent access to a given work if the right-holder has delivered information appropriate and necessary to achieve that purpose; and
• it acted promptly after receiving a duly justified request from the right-holder to block access to that work or remove it from its websites, and exercised due diligence to prevent future access to that work.

Merely responding to reported infringements will no longer be sufficient. Providers of online content services will be required to take a number of proactive measures to avoid liability.

Excluded providers

The bill also identifies categories of providers that will not be subject to the new liability rules. These include cloud services, online sales platforms, search engines, online encyclopaedias, scientific or educational repositories, or open-source software development platforms. However, this catalogue is closed so all other entities meeting the threshold will be covered by the new rules.

Further Development of 5G Networks

Further development of the 5G network in Poland is likely to continue in 2023. The 5G network is designed specifically for smart cities and the internet of things. Admittedly, the largest mobile network operators in Poland have already launched 5G networks and are offering an increasing number of devices (smartphones, modems, etc) to connect to modern base stations. Nevertheless, an auction of bandwidth dedicated only to 5G networks has not yet taken place.

According to the activity plan for the Office of Electronic Communications (Poland’s regulatory authority), one of the Office’s goals in 2023 is to make frequencies in the 3.6 GHz band available for the deployment of 5G technology. In practice, this means holding the aforementioned auction, including conducting a selection procedure for operators and issuing reservation decisions. The Office also plans to take steps to increase the percentage (up to 77%) of households within reach of internet access with a backhaul capacity of at least 100 Mbps.

New Wave of State Subsidies?

Investment in the telecommunications and technology space, especially taking into account the deployment of the 5G network, will be substantial. In the past, a lot of jurisprudence in state aid matters was related to financing the public remit or the development of broadband networks.

One of the biggest burdens in the last year was related to the release of the 700 MHz band by the terrestrial television services to make it available to develop the internet of things. One of the first decisions in which the European Commission approved aid was to replace the frequency-dependent equipment for broadcasting in the context of migration from the 700 MHz band that was issued for Spain (case SA.51080) and Czechia (case SA.55742). It is expected that similar aid may also be granted to some Polish broadcasters in 2023. However, the Commission also opened the formal procedure to investigate the aid granted by Czechia for terrestrial television parallel broadcasting in a new standard – ie, DVB-T2/HEVC. The Commission argues that the support granted to the terrestrial television services went beyond the scope needed to release the 700 MHz band, but allowed them to upgrade their network to make it capable of providing additional services and of better quality, while operators providing television transmission services on alternative platforms allegedly have invested in the transition to DVB-S2/MPEG4 (capital and operating costs) with private resources. As a result, there is a risk that the operators of terrestrial television services received a preference (case SA. 64153). Thus, it cannot be ruled out that, if aid is awarded to Polish operators of terrestrial television releasing 700 MHz, similar complaints will also appear.

Moreover, additional complaints may be triggered if the MCMO obligation is adopted in the way currently envisaged in the ECL as it may constitute an undue advantage for the Polish State broadcaster.