On 25 August 2023, the Act on Combating Abuses in Electronic Communication (CAECA) was published in the Polish Journal of Laws. While the act was enacted in full over a long period (starting on the next day after promulgation and continuing for twelve months from the day it took effect), the obligations under the new legislation will mostly begin to apply from 25 September 2023.

The main premise of the legislation is to combat abuses in electronic communication, defined as generating artificial traffic, smishing, CLI spoofing, and unauthorized change of details of address.

The task of combating abuses in electronic communication will mainly fall to telecommunications operators, and their new obligations will include:

Telecommunications operators will also be able to block access to certain listed websites that mislead and fraudulently obtain user data or do harm by disposing of assets. In addition, the President of the Polish regulator, the Office of Electronic Communications, will have the power to order a telecommunications operator to block a telephone number or service, and order that charging for calls or services be stopped. It will be possible to issue that order verbally, and the order will be effective immediately.

Other entities will also have new obligations under the new laws. E-mail providers that provide services for 500 000 users or more or for a public entity, will be required to deploy and apply additional mechanisms (SPF, DMARC and DKIM), while firms providing e-mail to public entities will be required to ensure that it has a multi-factor authentication option.

Entities that fail to comply with the new obligations could face an administrative fine of up to 3% of their revenue generated in the previous calendar year. There will also be criminal sanctions for fraudulent abuses in electronic communication.

Also, importantly, the CAECA makes frequent reference to Telecommunications Law provisions and taxonomy, which means that if the proposal (for which plans were announced long ago) for the Electronic Communications Law, intended to transpose the European Electronic Communications Code, is eventually passed, the CAECA will also have to be amended.

Author: Marcin Ręgorowicz, Piotr Konieczny