Make IT clear - 02/2023

The planned regulation sets out a number of initiatives to fund the development of the semiconductor market in the EU, including initiatives for chip supply chain monitoring mechanisms.

The Chip Act is expected to allocate €43 billion in public and private investment.

The regulation proposes the possibility of introducing a new legal instrument, the European Chip Infrastructure Consortium (ECIC). The ECIC would be the legal entity that could carry out the activities and other tasks funded under the 'Chips for Europe' initiative. 

Recent global semiconductor shortages have forced the closure of factories in various sectors of the economy. This has shown that the entire global economy is dependent on a semiconductor supply chain involving a small number of players in a complex geopolitical context. The Chip Act is intended to address the current shortage of semiconductors in Europe and reduce the Union's vulnerability and dependence on foreign players. 

The next step is the adoption of the position by the European Parliament. Once this is done, the Council and the European Parliament will start discussions. 

The following entities are required to comply with DORA:

• Financial institutions, including but not limited to: credit and payment institutions, electronic money institutions;
• Managers of alternative investment fundsZarządzający alternatywnymi funduszami inwestycyjnymi;
• Management companies;
• ICT third-party service providers.

Definitions of the above entities can be found in the DORA and related legislation. 

DORA regulates:

• ICT risk management inter alia the appointment of a person or function responsible for monitoring arrangements with external ICT service providers, staff and management training, systems register and identification of ICT processes.
• ICT incident reporting e.g. classification of ICT incidents and determination of their impact on the organization, rules for informing customers and service users of incidents, implementation and execution of a comprehensive ICT business continuity policy.
• Digital operational resilience testing, e.g. frequency of testing of key ICT systems and applications, scope and frequency of penetration testing of IT systems supporting critical processes in the organization, comprehensive risk-based digital operational resilience testing programme, requirements for a digital resilience test provider.
• Risk monitoring from external ICT service providers, inter alia, contractual requirements between the bank and the ICT provider, contract inventory, risk assessment of external ICT providers before signing a contract, right of financial entities to audit ICT providers.
• Inter-bank exchange of information on cyber threats and results of analyses of such cyber threats. 

DORA gives Member States the power to prescribe administrative penalties or remedial measures of DORA, including at least:

• issuing orders involving the cessation or refraining from engaging in specified activities;
• ordering the temporary or permanent cessation of a specific action;
• adopting all types of measures, including those of a monetary nature, to ensure that financial entities continue to comply with legal requirements;
• requesting the issuance of telecommunications records;
• issuing public notices, including making public information indicating the identity of the natural or legal person and the nature of the breach.

We invite you to read the Report by EY Poland and the Polish Banks Association "The DORA Regulation - revolution or evolution in the Polish banking sector? Analysis of the maturity of the banking sector in terms of digital operational resilience and a survey on the state of digital resilience of Polish banks".

The report contains the results and conclusions of a survey conducted by EY Poland and the Polish Bank Association among institutions in the Polish banking sector. In addition, a number of assumptions and obligations arising from DORA are presented, as well as the challenges posed by the new regulation.

The report can be downloaded at the link: EY and ZBP report: DORA Regulation

Datatilsynet makes the manner and extent of compliance with the obligation under Article 13 or 14 GDPR dependent on the stage of development in which the AI used is located.

For example, during the development stage of AI, the exception in Article 14(5) GDPR, which exempts the controller from the information obligation when personal data is not obtained directly from the data subject and providing information about the processing proves impossible or would require a disproportionate effort, could apply.

According to Datatilsynet, the aforementioned provision could be applicable as AI systems often require huge amounts of data, which could impose a heavy burden in terms of effort to inform each individual about the processing of their data. However, Datatilsynet recommends providing a minimum of information about the processing, e.g. through publicly available channels (e.g. websites).

During the application phase of AI, it will be important to determine whether the model will be used only as a decision support or for full decision automation.

In the latter case, the GDPR requires the controller to provide not only information that such automated decision-making will take place, but also about the right not to be subject to such processes, relevant information about the modalities of such decision-making, as well as the significance and anticipated consequences of such processing for data subjects. Datatilsynet, on the other hand, recommends that similar information should also be provided for AI used only as decision support. Similar requirements will apply to AI systems in the post-learning phase of the system.

Datatilsynet emphasized the role of user trust in artificial intelligence systems.

Doubts may arise particularly in relation to the misuse of personal data, e.g. an employee's fear that their data will be used by their employer for purposes other than those presented to them. This may result in incorrect information being provided and, consequently, the system generating incorrect results.

The Authority suggests presenting the information obligation related to the use of AI to the test group in the first instance, thus exploring the reaction of the target group in terms of, among other things, what data they will be reluctant to share, thus highlighting the importance of the vocabulary used by the controller in complying with the GDPR information obligation.

The report also includes a list of issues to consider when complying with the GDPR transparency obligations, which can be read here.

The President of the UOKiK drew attention to the following irregularities:

• Provision of the current sales price and crossed out price without specifying what the crossed out price actually is.
• Provision of the current sales price and crossed out price, where the explanation that the crossed out price is the lowest price of the item in 30 days before the discount is shown only after it is expanded.
• Calculating the amount of discount (e.g. 20%, PLN 150) in connection to the last standard price of an item and not the lowest one from the last 30 days.
• Using phrases other than “lowest price in 30 days before the discount”, i.e. “reference price”.
• Presenting information on the lowest price in place within 30 days before the discount in an illegible manner: font, colours, contrast. 

The President of UOKiK called entrepreneurs to provide explanations and change questionable practices. The President of the UOKiK called on the inspected entrepreneurs to provide explanations and change the questioned practices. If they do not comply, the President of the UOKiK announced further possible actions, including bringing charges of violating collective consumer interests.

The President of UOKiK, in case of ascertaining the breach of collective consumer interests may impose a penalty of up to 10% of turnover per company and up to PLN 2 million per manager.

• The seller should display the lowest price of the 30 days prior to the discount in a way that is clear and unambiguous to the consumer. The lowest price may be crossed out (as long as it is still legible).
• The seller should indicate next to the price displayed as the reference price that it is the lowest price of the last 30 days before the reduction. It is bad practice to present this message only after the link has been expanded or in a much smaller font than the reduced price, using illegible colour or low contrast. The information about the lowest price should be presented in close proximity to the current price.
• If the seller sells goods via different channels (e.g. in stationary shops and online shop) and advertises a price reduction in these channels, he must indicate the lowest price applicable in the 30 days prior to the reduction, relevant to each sales channel.

The Authority will also soon be looking into:

• whether and how do entrepreneurs operating online, who provide consumer opinions, inform consumers on the manner of verifying their reliability (if they do not conduct such verification, they should also inform the consumers of the same);
• whether and how retail platforms provide information on the main parameters deciding on the order the products appear in search results, as well as whether and how they disclose which offers are paid advertisements or were placed higher due to a payment;
• whether and how the platforms provide information on the status of the person offering goods or services - whether it is an entrepreneur or private individual;
• whether entrepreneurs operating online provide a phone number allowing consumers to effectively contact them.

For more information, please follow the link: UOKiK - About us - About us - News - #ConsumerRights2023 - President UOKiK says "call"