POLAND Law and Practice Contributed by: Tomasz Konopka, Katarzyna Randzio-Sajkowska, Katarzyna Stradomska-Balcerzyk and Michał Zieliński, Sołtysiński Kawecki & Szlęzak
the effectiveness of environmental protection, also imposing more severe financial penalties against such entities. The aforementioned Directive introduces significant changes to European environmental criminal law. Key Changes in Criminal Law Expansion of the scope of criminal offences The Directive introduces new categories of environ - mental crimes, including: • illegal timber trade offences involving timber from illegal sources; • ship recycling offences not compliant with regula - tions; • illegal waste export offences from the EU; • serious air, water, or soil pollution offences; and • habitat destruction offences in protected areas. New definitions and standards The Directive clarifies definitions of key concepts: • “Substantial environmental damage”, including long-term or irreversible effects; • “Qualified offences”, when actions cause death or serious bodily harm; and • “Organised criminal group activities” in the context of environmental crimes. Criminal Sanctions Requirements Minimum penalty levels The Directive establishes minimum standards for pen - alties: • for natural persons: imprisonment with a maximum term of at least five years for basic offences; • for qualified offences: penalties with a maximum term of at least ten years; and • for legal persons: effective, proportionate, and dis - suasive financial sanctions. Additional penalties Member states must provide for the possibility of imposing: • a prohibition from conducting business activities related to the offence;
• an obligation to restore the environment to its pre - vious state; • the confiscation of benefits obtained from the crime; and • the prohibition from applying for public funding or participating in public procurement. Legislative Process Next year may bring also changes in the cybersecu - rity field. Consultations are being conducted on the bill amending the Act on the National Cybersecurity System. The main goal to achieve is to comply with the NIS2 regulations. Key Obligations Under the NIS2 Directive Cybersecurity risk management Entities covered by the NIS2 Directive must imple - ment appropriate and proportionate technical, opera - tional, and organisational measures to manage risks to the security of network and information systems. These measures must be designed to ensure a level of security appropriate to the risk presented, taking into account state of the art technology and the costs of implementation. Incident reporting The Directive introduces mandatory incident reporting obligations with strict timelines: • initial notification: within 24 hours of becoming aware of a significant incident; • detailed incident report: within 72 hours, including an initial assessment of impact and severity; and • final report: within one month, providing a detailed description of the incident, its impact, and response measures taken. Incidents must be reported to the relevant national competent authority or Computer Security Incident Response Team (CSIRT). Management accountability NIS2 places direct responsibility on management bodies for overseeing cybersecurity measures. This includes: • approving cybersecurity risk management meas - ures;
246 CHAMBERS.COM
Powered by FlippingBook