As of 7 February 2016, access to electronic communications and digital data is easier for state authorities, due to an amendment that expands surveillance powers and restricts citizens’ rights to privacy.

By Paweł Tobiczyk

The Constitutional Tribunal’s judgment

The amendment of the Police Act and legislation regarding other secret services aims to enact Polish Constitutional Tribunal judgment dated 6 August 2014 finding that law enforcement operations did not have proper oversight.

Under previous legislation, law enforcement was entitled to collect billing data from telecommunication companies indirectly, immediately and without limits.  The Tribunal ordered implementation of legislation to oversee the disclosure of such data, and the immediate destruction of surveillance material subject to professional secrecy. The Tribunal also considered that a monitored person must be informed about activities relating to her/him once monitoring has finished. The Tribunal held too that the maximum duration of surveillance should be precisely defined in the law.

New police and secret services powers

The amendment brings important changes to the rules for accessing data and conducting surveillance of citizens’ activities, especially in relation to electronic communications and digital data.

• Permissible surveillance techniques are much broader than previously, and notably include previewing and recording audio and video on premises, in transport and even in areas that are not public; controlling and storing the content of personal correspondence (including electronic); obtaining data from information media, telecommunications terminal equipment, and IT and telecommunications systems.
• Surveillance generally does not require obtaining a court order, and may last up to 18 months, and in some cases indefinitely.
• The court is entitled to oversee surveillance, but only ex post: police and secret services are obliged to provide the court twice a year with reports regarding the activities they have pursued concerning accessing personal data and confidential information of citizens.
• Surveillance is allowed not only in case of reasonable suspicions that somebody committed an offence but also in order to prevent such situations.

Access to ‘Internet data’

The prerogatives of the police force were extended to so-called “Internet data”, which is not clearly defined by the Polish Act on Rendering Services by Electronic Means. Under this Act all data necessary for the provision of services by electronic means can be treated as Internet data, and potentially the definition can cover the content of private messages.The amendment raises serious doubts:

• Internet data can be processed without consent of data subjects and the prior permission of a court.
• Access to Internet data does not have to relate to a particular criminal proceeding, since police and other services are able to preview users “preventively” by checking which websites they visit and what activities are conducted, and then deciding whether an offence was committed.

By permitting access to such a breadth of data, taking into account the wide range of situations when surveillance is allowed, it is possible to understand with great precision the activities of internet users, including activities relating to their private life, which may infringe the right to privacy.

Incompatibility with the Constitutional Tribunal ruling

According to the majority of experts and the Constitutional Tribunal itself, the amendment does not correctly implement the Tribunal’s judgment and is not consistent with law currently in force:

•  Persons who were under surveillance must be informed that their data is collected and processed.

• The law must ensure independent oversight of each case of telecommunications data disclosure.
• If telecommunications data of persons subject to professional secrecy (e.g., attorneys or journalists) is accessed, an independent authority (such as a court) must approve police or secret services collection of such data.
• The conditions when access to telecommunications data is permitted must be limited (such access should be allowed only in case that use of other methods are ineffective).

As a consequence, it is likely that the amendment is contrary to national and EU law and a challenge could be mounted.

For more information, please contact Paweł Tobiczyk (pawel.tobiczyk@dlapiper.com).