POLAND Law and Practice Contributed by: Tomasz Konopka, Katarzyna Randzio-Sajkowska, Katarzyna Stradomska-Balcerzyk and Michał Zieliński, Sołtysiński Kawecki & Szlęzak
chase of such services in a manner inadequate to their nature, breaching the obligation to provide reliable, correct and complete information to consumers, or performing unfair market practices or acts of unfair competition. The aforementioned are administrative offences. The ACCP provides for one petty offence related to consumer criminal law under its Article 114, which states that any person who is in breach of the obliga - tion to provide the explanations and information as may be required by the consumer ombudsman, or to respond to the comments and opinions of the con - sumer ombudsman, shall be liable to a fine of no less than PLN2,000. 3.9 Cybercrimes, Computer Fraud and Protection of Company Secrets Classification of Cybercrimes According to Article 287 of the CC, anyone who commits computer fraud, ie, influences automatic data collection, processing or transfer without due authorisation, alters (for example, SQL-injection-type attacks), deletes or creates electronic records with intent to obtain material benefit or cause damage to others, is liable to imprisonment for a period of three months to five years. According to Article 278 Section 2 of the CC, who - ever, without the permission of an authorised person, obtains someone else’s computer software with the purpose of gaining material benefit, is subject to the penalty of deprivation of liberty for between three months and five years. According to Article 269a of the CC, anyone who sig - nificantly interrupts the operation of a computer sys - tem or an IT network by means of data transmission (eg, distributed denial-of-service attacks), deletes, corrupts, or alters data, or restricts access to data (eg, via ransomware attacks), will be subject to the same penalty. Additionally, as stated in Article 268a of the CC, the unauthorised deletion, destruction, and restriction of access to electronic data (eg, via ransomware attacks), as well as the prevention of access to or automatic processing of such data, is subject to imprisonment of
up to three years. If the perpetrator causes significant damage, they are liable to imprisonment for a period of three months to five years. Pursuant to Article 269 of the CC, corruption, altera - tion, or deletion of any data of particular significance for national defence, transport security, operation of government or local government or interruption or prevention of access to such data or its processing is subject to a penalty of imprisonment for a period of six months to eight years. Destruction or exchange of related hardware is subject to the same penalty. Moreover, under Article 269b of the CC, anyone who prepares, obtains, transfers, or sells any devices or software enabling the user to commit the above offences (this covers various “back doors”, “Trojan horses”, keyloggers, webcam hacks, botnet-related software, viruses, ransomware software, etc), as well as computer passwords, access codes or other data enabling unauthorised access to information stored in an IT system or IT network, is subject to the penalty of deprivation of liberty for between three months and five years. Exemptions There is an exemption from criminal liability of per - sons performing penetration tests at the request of the interested party, ie, launching controlled attacks, preparing software intended to find and test so-called exploits, and sending spoof mails to check employ - ees’ cybersecurity awareness. Bug bounty programmes are also decriminalised. Hunting bug bounties will not constitute an offence if the person who identified a “bug” (malfunctioning software), security loophole, or other exploit caused no damage by their activity (either to the interested entity or to the public interest) and immediately informed the administrator of the relevant system or network of the “bug’s” existence and the threat it could pose. Cybercrime Related to Payment Instruments Cybercrimes related to payment instruments (eg, pay - ment card systems) remain a major challenge to Polish prosecutors. Apart from being classified as the earli - er-discussed “computer frauds”, they are sometimes considered to be regular frauds (subject to a penalty of
239 CHAMBERS.COM
Powered by FlippingBook