Make IT Clear - 01/2023

The key problem the Council had to solve was defining an artificial intelligence system. The adopted project assumed that an "artificial intelligence system" is a system that is designed to operate in a partially autonomous manner and that, based on machine- or human-provided data and information, infers how to achieve a preset set of goals - using machine learning technologies or logic- and knowledge-based methods that generate results, such as content, predictions, recommendations or decisions, that affect the environments with which the system interacts.

Among the prohibitions, the adopted approach includes:

• for the purpose of scoring citizens' social behaviour (social scoring), which leads to discrimination;
• which use subliminal techniques and have the purpose or effect of altering a person's behaviour to the detriment of that or another person;
• which exploit the vulnerability of a specific group of people; it now also includes people who are disadvantaged by their social or economic situation;
• by law enforcement agencies for remote 'real-time' biometric identification in public places for law enforcement purposes (with some exceptions)

Once the European Parliament adopts its position, negotiations between the Council and Parliament can begin.

• Risk analysis and IT system security policy - a multi-stage analysis will be required, including both analysis of actual security (buildings, equipment, etc.) and cyber security understood as the security of the networks in which the organisation operates, as well as individual employees;

• Incident handling (prevention, detection and response, reporting) - an entity covered by NIS 2 will be required to set up internal structures responsible for cyber security, and will be required to inform both the competent authority and the dedicated CSIRT.

• Business continuity and crisis management - business continuity will be understood here as a sub-type of risk management focusing on ensuring the continuity of the business despite a security incident.

• Supply chain security - key and important actors will be required to consider (and take appropriate measures for) supply chain security, including the security aspects of the relationship between each actor and its suppliers or service providers, such as providers of data storage and processing or managed security services.

• Security in Network and Information Systems - NIS 2 identifies two international standards that should be used by network and information system developers as guidelines for vulnerability handling and disclosure: ISO/IEC 30111 and ISO/IEC 29417.

• Testing and auditing - mandatory audits should cover both physical and cyber security.

As NIS 2 is a directive, Member States must implement it into their national legal order. It is currently unclear how individual member states will approach the implementation of NIS 2 into their legal orders. However, as the NIS 2 Directive imposes obligations on IT providers to implement new technological and organizational processes, these entities may already be looking at their critical processes, services and resources so that they can more nimbly comply with their obligations once NIS 2 is implemented into the Polish legal order.

The adequacy decision is one way to legally transfer personal data outside the European Union.

The adequacy decision is, from the data exporter's point of view, the most convenient protection mechanism when transferring data outside the EU.

A decision is issued for an entire country, territory, sector or organization when the European Commission determines that adequate protection for personal data, adequate to the EU level, is provided thereby. In such case, the Commission adopts a decision by means of an implementing act, which ensures that no special authorization is required for the transfer of personal data to a particular country/sector in a third country or international organization.

The transfer of data to such a country can be treated as a transfer to an EU country.

To date, 14 valid adequacy decisions have been issued.

On 13 December 2022, the European Commission has published a draft decision to recognize an adequate level of protection for personal data in the US.

The draft decision follows US President Joe Biden's signing of an executive order in October 2022 to put in place safeguards for the personal data of EU residents, in particular by limiting access to US intelligence agencies' data and introducing an independent redress mechanism.

If the draft decision is approved and signed, this will facilitate transfers of personal data to the US and exempt the use of additional safeguards under either Article 46 or 49 of the GDPR.

You may recall that on 16 July 2020. CJEU issued its judgment in the Schrems II case (C-3111/18), in which it questioned the mechanisms for the transfer of personal data between the EU and the US. In this judgment, the CJEU indicated that US law does not provide equivalent protection to that required by EU data protection standards. Accordingly, the CJEU declared Commission Implementing Decision (EU) 2016/1250 of 12 July 2016 on the adequacy of the protection provided by the EU-US Privacy Shield to be invalid.

For more information on the transfer of personal data outside the EU, please follow the link: Transfers of personal data outside the EEA - challenges in 2022 | EY Poland

As the above regulations have been adopted by the EU in the form of a directive, each Member State must implement the directive in its national order. The Omnibus, Digital and Goods Directives are implemented by two laws in Poland. The Act of 1 December 2022 amending the Consumer Rights Act and certain other acts implements the Omnibus Directive, while the Act of 4 November 2022 amending the Consumer Rights Act, the Civil Code Act and the Private International Law Act implements the Digital Directive and the Goods Directive.

The legislator rightly assumed that the changes introduced by the three aforementioned directives enter into force at the same time, i.e. on 1 January 2023. 

• Longer time limit for making a complaint, i.e. 6 years from the date on which the product defect was discovered;
• A longer period for the seller's liability for product defects because it covers the entire shelf-life, e.g. if the shelf-life is 3 years, the warranty will also last for 3 years, and if the shelf-life is less than 3 years, then the warranty will last for 2 years. 

• New requirements to exclude the 'right to return' of electronic products within 14 days. As many as 3 conditions must be fulfilled, i.e.: the customer's prior consent to the delivery of the digital product before the expiry of the 14 days, information about the loss of the right of withdrawal and the customer's acknowledgement of this information, and the sending of an acknowledgement of receipt of the consent to the customer.

• The retailer is obliged to make its contact number available to customers. Under the old legislation, this was voluntary;
• Obligation to inform about other online means of communication for continuity of correspondence, if available in the shop.

• Obligation to indicate next to the current price the lowest price for the product in question applicable in the last 30 days before the reduction was introduced;
• Obligation to inform about the individual adjustment of the price for the consumer if it has been set based on automated decision-making.

• Obligation to inform consumers whether product reviews made available have been verified by the trader. Verification of an opinion is limited only to establishing whether the author of the opinion has used or purchased the product. A trader may publish unverified opinions, but must inform customers of the lack of verification.
• A trader who will allow access to consumer reviews will have to indicate how he controls and verifies the reviews issued to him.

• Providers of an online trading platform will be required to inform the consumer whether the seller offering goods, services or digital content on the platform is a trader or selling as another consumer;
• Informing consumers of the main parameters determining the placement of offers presented to the consumer as a result of a search;
• Obligation to inform about the non-application of consumer legislation to a contract concluded on an online platform when the party offering the good or service is not a trader;
• Information about the division of responsibilities between the owner of the online platform and a third party who offers its products on the platform, when this contract is concluded with a consumer.

It is imperative that traders review their existing online sales regulations, withdrawal and complaint forms and update them. In addition, they should make changes to the interface of the online shop and also analyze the purchase process in the online shop.

The EY Law Digital team can help you identify whether the new obligations apply to you and to what extent. Our team can also help you make the necessary changes to your terms and conditions, privacy policies and other clauses.