The Liability of Entities Providing Services by Electronic Means for Digital Content

Abstract

As a result of computerisation, digitisation and informatisation of human activities, cyber responsibility became a key and indispensable issue related to human functioning in cyberspace. One of its aspects is the liability of service providers for digital content shared in network and information systems. This issue is increasingly important as the Internet has become a medium of exchange for ideas, views and content, and thus, a potential place of abuse, both from service providers and end users.

This article aims to show the legal regulations regarding the scope of liability of entities providing electronic services for digital content provided under Polish legislation, with particular emphasis on the obligations incumbent on service providers and indication of limitations of liability in the case of mere conduit, caching and hosting services, upon fulfilling certain regulatory requirements. This article also deals with the issue of protecting the copyrights to works unlawfully made available on the web by users and the scope of responsibility of service providers for the above activities.

1 General Remarks

The overall picture of our society has been transformed as a result of technological and technical progress. New forms of communication and new social habits have become engrained in society’s DNA. We have become an information society for which creating, collecting and sharing information are crucial, and computers, the Internet, and digital technologies in general, are becoming some of the most important aspects of life.¹ Thanks to the web, every user has become a potential author of content, and information has become a commodity. That is why the digital revolution has had an impact on law. The creation of legal regulations on the economic use of the Internet is of key importance in the information society in harmonising activities related to e-services. One aspect of the regulations is the definition of legal responsibility for content posted on the Internet, and, more specifically, of who is responsible, and under what conditions, for the infringement of third-party rights caused by posting content on the Internet. Until the adoption of the Directive on electronic commerce² by the European Union, the issue of business activities on the Internet, and, consequently, the liability of entities providing services by electronic means, had remained the prerogative of individual states, which did not know exactly how they should classify legal infringements on the Internet. The situations described below should serve as clear examples.

On 6 May 1996, the Paris police arrived on the premises of World-NET and FranceNet, two French companies providing Internet services in France, with a search warrant for all their premises and equipment.³ As a result, the head of World-NET and the CEO of FranceNet were charged under Articles 227-23 of the French penal code⁴ for the dissemination, recording, and transmission of child pornography. The reason for the arrest and detention was that companies provided access to Internet groups and forums on which paedophilic content was posted and exchanged. During the court hearing, the adjudicating authority concluded that the service provider could not be held liable, because it did not have the authority to filter the content posted on the Internet by other users, as this was contrary to French constitutional law.⁵ The case for paedophilia was dropped.

In 1998, an action for disseminating a naked image of a model on the Internet was brought against Valentin Lacambre, one of the French owners of a server—a device on which websites are stored in the computer’s memory and which provides access to the network.⁶ The photo had previously appeared in a French magazine, and was then uploaded onto the server by one of the network users who used the hosting service of the server’s owner. In the first instance, the referring judge, Jean-Jacques Gomez, stated “It is necessary to specify that the hosting provider is obliged to guarantee the moral standing of those it hosts and that these parties respect the statutory rights of third parties”. The judge adjudicated against Valentin Lacambre, imposing a penalty of 100,000 Francs, and prohibited any dissemination of the image of the model in the photo.⁷ An appeal was lodged against this ruling. Judge Marais, hearing the case in the second instance, ruled that, in so far as the defendant allowed Internet users to express themselves online, he “has clearly exceeded the role of a mere conduit of information” and must therefore be responsible for the content of the sites he hosted. The defendant was ordered to pay 300,000 Francs compensation and 100,000 Francs penalty per day.⁸

What do these two cases have in common? They are both related to the activities of entities providing services by electronic means, and involve data produced and delivered in digital form, and also raise the issue of liability for such activities. Furthermore, they initiated a public debate on the obligations and powers of Internet service providers, and specifically whether electronic-service providers are responsible for the content posted by network users.

The issue of defining the scope of responsibility of entities providing services by electronic means also become a subject of public debate in Poland. It resulted in the enactment of the Act on Providing Services by Electronic Means by the Sejm of the Republic of Poland on 18 July 2002.⁹ This Act contained regulations implementing the Directive on electronic commerce, despite the fact that Poland was not yet formally a Member of the European Union.

2 What Is Digital Content?

Under Polish law, for the first time, the definition of “digital content” was included by the legislators in Article 2 of the Act on Consumer Rights of 30 May 2014,¹⁰ according to which digital content should be understood as data produced and supplied in digital form. This definition, taken from Article 2(11) of Directive 2011/83/EU of the European Parliament and of the Council of 25 October 2011 on consumer rights¹¹ (and subsequently repeated in the Digital Content Directive¹²), is very vague, and, therefore, includes a broad and open catalogue of the possible scope of digital content. Recital 19 of the abovementioned Directive, which specifies “Digital content means data produced and supplied in digital form, such as computer programs, applications, games, music, videos or texts, irrespective of whether they are accessed through downloading or streaming, from a tangible medium or through any other means”, is helpful in interpreting this provision.¹³

It appears that the meaning of digital content as suggested by the legislators is justified. The digital revolution is characterised by rapid technological and technical development, and, thanks to such a universal, general, and technologically neutral approach to the definition of digital content, this definition does not become outdated.¹⁴

The definition covers data produced and supplied in digital form “irrespective of whether they are accessed through downloading or streaming, from a tangible medium or through any other means”. Therefore, the category of digital content will also include data in other forms, which will then be digitised and delivered in digital form.¹⁵

Seemingly, the Polish legislators approached the issue of digital content in a slightly different way in Article 2(29a) of the Act on Payment Services of 19 August 2011,¹⁶ stipulating that this term should be understood as “goods or services produced and supplied or rendered in digital form, which may be used or enjoyed exclusively by means of a technical device, excluding the use and consumption of physical goods or services”. The legislators have thus explicitly described the scope of digital content as including goods and services. However, the discrepancies in terminology which arise from the interpretation of the concept of digital content contained in the Act on Consumer Rights and the Act on Payment Services do not concern the very essence of digital content, but affect the nature of a contract the subject of which is digital content.¹⁷

Digital content is data produced and delivered in digital form. The term “data” usually means everything which is or can be processed, either mentally or by a computer, and is transmitted to the recipient’s consciousness in the form of a message.¹⁸ We use specific means to obtain information from data. In the case of digital content, information is obtained through the use of appropriate hardware and software, examples of which include material in the form of music files, photographs, videos, e-books, or apps.¹⁹ In general, data must meet two conditions in order to be referred to as digital content—it must be produced and delivered in digital form, but the production does not have to mean original production—and the original form may be analog which has been digitised.²⁰ As far as supply is concerned, the term should be understood as “transmission by electronic means – either wired or wireless, and reception by means of devices facilitating their processing, storage, and reproduction”.²¹

On the basis of recital 19 of the E-Commerce Directive, two types of digital content can be distinguished, i.e. data received on a tangible medium, or received through any other means. This distinction is pertinent for determining the legal nature of contracts for the supply of digital content, since, according to recital 12 of the Digital Content Directive, “This Directive should also not determine the legal nature of contracts for the supply of digital content or a digital service, and the question of whether such contracts constitute, for instance, a sales, service, rental or sui generis contract, should be left to national law”. More importantly, however, the provisions of the Digital Content Directive will apply, notwithstanding the medium used to transmit or make available a digital content or service. This means that where digital content is received on a tangible medium used exclusively for the supply of digital content, the provisions of the Directive apply to both the medium, provided that it functions only for the supply of digital content, and the content recorded on it (Article 3(3). Digital content contained in goods or interconnected with them is excluded from the scope of the Directive. Here, the EU legislators have introduced a category of “goods with digital elements”, such as smart phones, which contain pre-installed applications, and included them in the ambit of Directive 2019/771.²²

The legal definition of a tangible medium is contained in Article 2(4) of the Act on Consumer Rights. On the basis of Article 2(4) of the Act on Consumer Rights,

Any material or tool which enables a consumer or trader to store information addressed personally to him or her in a way which allows future access to the information for a period of time adequate for the purposes for which the information is intended, and which allows the unchanged reproduction of the information stored, should be regarded as a tangible medium.

A similar definition exists under the Digital Content Directive, except that instead of “material or tool”, the EU legislators have used the term “instrument”. (Article 2(13)). However, in the Digital Content Directive itself, the EU legislators introduced yet another term, namely “durable medium”, which causes some conceptual confusion. The question therefore arises whether “durable medium” and “tangible medium” are identical expressions. When interpreting recital 20 of the Digital Content Directive²³and recital 23 of the Consumer Rights Directive,²⁴ it becomes clear that both concepts describe similar categories of media. However, as K. Chałubińska-Jentkiewicz points out, “A tangible medium does not include information stored in broadly defined electronic mail or in cloud tools”.²⁵ Therefore, we cannot consider these concepts to be identical.²⁶

Receiving digital content through any other means can include, inter alia, downloading from the network, streaming in the form of access to digital content stored in the cloud, and accessing social media.

When considering matters relating to digital content, the issue described in recital 42 of the Digital Content Directive also requires considering. It stipulates that digital content should be characterised by security, functionality, compatibility, and interoperability. We can find an explanation of the different qualities of digital content in the directive itself, which states in recital 43

The notion of functionality should be understood to refer to the ways in which digital content or a digital service can be used. For instance, the absence or presence of any technical restrictions such as protection via Digital Rights Management or region coding could have an impact on the ability of the digital content or digital service to perform all its functions having regard to its purpose. The notion of interoperability relates to whether and to what extent digital content or a digital service is able to function with hardware or software that is different from those with which digital content or digital services of the same type are normally used. Successful functioning could include, for instance, the ability of the digital content or digital service to exchange information with such other software or hardware and to use the information exchanged.

In addition, Article 2(10) includes a definition of compatibility, which should be understood to mean the ability to interact with devices and software with which digital content is normally used, without having to be transformed.

3 Entities Providing Services by Electronic Means

In order to decode the notion of an entity providing services by electronical means, the two statutory concepts contained in Article 2(4) and (6), of the PSEMA should be interpreted—electronically supplied services, and the service provider. Such a process will make it possible to identify the subject and the issue in question.

According to the legislators’ intent, providing services by electronic means involves the performance of services which must meet all the following conditions: the service must be performed without the parties’ being present at the same time, i.e. remotely; the service must be performed by transmitting data at the individual request of the service recipient; the data must be sent and received by means of electronic-processing devices, including digital compression and data storage; and the data must be transmitted, received, or transmitted by means of a telecommunications network within the meaning of the Telecommunications Law of 16 July 2004. It follows from the above that the legislators did not introduce a definition of a service provided by electronic means, but defined it by indicating the elements of the method of its provision.²⁷

The lack of the simultaneous presence of both parties means that there is no physical or direct contact between the provider and the recipient in the same location in the performance of the service, which is sent and received by means of electronic devices designed to store or process the data transmitted. As emphasised by legal commentators,

It is significant that the moment of performance of the service decides, and not the moment of ordering the service (the conclusion of the contract), as in the case of distance contracts within the meaning of Article 6 of the Act on the Protection of Certain Consumer Rights and Liability for Damage Caused by a Dangerous Product of 2 March 2000.^28,29

An individual request means the provision of a service “at the request” of the recipient, namely at a place and at a time individually chosen by the recipient.³⁰ Examples include VOD (video-on-demand) services, web browsing, and sending text and image messages. However, this category does not include services consisting of the transmission of data received by an unlimited number of people, such as radio and television broadcasts, because the recipient of the service does not have the possibility to choose the time of providing the service—he or she can only join it.³¹

The legislators did not include a definition of a “device for the electronic processing and storage of data”, which can give rise to some interpretation problems in practice. In the literature, we might encounter opinions that this term should be understood as

part of a communication and information system in the form of a telecommunications terminal device within the meaning of the Telecommunications Law. Sending, receiving, processing, and storing data, from a technical point of view, will be effected by means of such a device. This premise is connected with an important feature of a service provided by electronic means, i.e. the absence of a material substrate.³²

According to Article 2(46) in conjunction with (48) of the Telecommunications Law,³³ telecommunications equipment is any electric or electronic device intended to provide telecommunications, i.e. to transmit signals on a telecommunications network. However, not every use of such equipment will be equivalent to the provision of electronic services, such as ATMs, motorway toll collecting devices, or medical consultations by telephone.³⁴

The final requirement is the transmission, receiving, or transmitting data over a telecommunications network, meaning “transmission systems, and switching or routing equipment and other resources, including network elements which are not active, which permit the transmission, reception, or transmission of signals by wire, by radio, by optical or other means using electromagnetic energy, regardless of their type”. (Article 2(36) of the Telecommunications Law).

Bearing in mind that the provisions of the PSEMA are a transposition of the regulations contained in the E-Commerce Directive, it is worthwhile at this point to refer to the solutions adopted by the European Union. The EU legislators do not use the term included in the Polish legal order. Instead, they introduce the concept of “Information Society services”, which, in accordance with Directive 98/34/EC,³⁵ should be understood to mean any service normally provided for remuneration, at a distance, by electronic means, and at the individual request of a recipient of services. It can be noted that the PSEMA does not refer to the gainful nature of services, which is present in the case of “Information Society services”. However, this does not mean that the PSEMA applies to a category of services wider than Directive 2000/31/EC. This gap is filled by Article 2(6) of the PSEMA, which provides a legal definition of a service provider. According to this definition, a service provider may be a natural person, a legal person, or an organisational entity without a legal personality, which provides services electronically, even if it is performing as an incidental, gainful, or professional activity. Legal commentators therefore assume that the term “Information Society services” is synonymous with “services provided by electronic means”.³⁶

An entity does not have to provide a service in an organised and continuous manner to be recognised as a service provider, as described in Article 3 of the Entrepreneurs’ Law. Such a solution is supported by the use of the phrase “even if only incidentally”, which also makes it possible to classify as a service provider those entities which only incidentally provide services by electronic means.³⁷

As M. Świerczewski rightly points out,

The provision of Article 2(6) of the PSEMA is modelled on Article 2(b) of Directive 2000/31/EC. The term ‘usługodawca’ is equivalent to the term service provider used in the Directive. In Directive 2000/31/EC, in addition to the concept of service provider, there is also the concept of ‘ustanowiony usługodawca’ (established provider). The introduction of this category of service providers is important mainly depending on the country-of-origin principle.³⁸

Legal commentators distinguish between providers of electronic services. J. Barta and R. Markiewicz differentiate the following categories of entities: administrators/operators of a telecommunications network—telecommunications companies; access providers—entities providing a service to facilitate access to a network without any influence on the content transmitted in the network; original-content providers in the network; content providers—entities whose activities consist of introducing “own” content into the network, which allows downstream users to use this material; and service providers.³⁹ M. Zieliński distinguishes three categories of service providers: access providers, network providers and intermediary service providers, who transmit, store and make information available on the Internet. It also identifies content providers.⁴⁰ The introduction of the categorisation of entities is of great importance in the issue of determining liability for a breach of law in the network, because liability is determined on the basis of the type of activity of entities providing services by electronic means. Furthermore, in some cases there is a convergence of services provided by the same entity, which makes it difficult to assert the rights of third parties.

When interpreting the individual provisions contained in the PSEMA, we can notice that the Polish legislators have also introduced a categorisation of entities which should be understood as entities providing services by electronic means. This list has been included in Articles 12–14 of the PSEMA, on the basis of which we can point to mere conduit service providers; hosting service administrators (host providers), and entities providing caching services. It should be remembered, however, that this is not an exhaustive list, and these are not all the entities which fall under the definition. The criterion used by the legislators to distinguish the above categories is the possibility to exclude liability in connection with the provision of specific electronic services.

4 The Liability of the Providers of Services by Electronic Means

The type and extent of the liability borne by the providers of services by electronic means is diverse. In the Polish legal system, content providers are fully and directly liable for the infringement of third-party rights on general terms.⁴¹ This is due to the fact that they are the “authors” of the content they post, which will ensure that “in terms of liability, their legal situation does not differ in any way from the status of other legal entities responsible for their own actions”.⁴² Thus, depending on the nature of the infringement they commit, they will be held criminally, civilly, or administratively liable under the rules of a particular domain of law.

In contrast, the issue of liability has been regulated with regard to so-called intermediary service providers, with which we can include services of: mere conduit, data storage for accelerating data transmission (catching) and data storage for sharing (hosting). In these cases, the liability of the intermediary for the transmitted digital content may be waived if the statutory requirements of the PSEMA are met. The drawing up of the exclusions has been implemented from the E-Commerce Directive, where it is of a horizontal nature, thus eliminating any liability for a breach of law—whether on criminal, civil, or administrative grounds.

5 Mere Conduit

An entity providing services by electronic means, including the transmission in a telecommunications network of data transferred to the recipient of the service, or the provision of access to a telecommunications network, having fulfilled the conditions of Article 12(1) of the PSEMA, is not liable for the digital content transmitted in this manner, or the activities related to it.⁴³ The transmission in question is a service involving mere conduit of information, i.e. passive participation in data transmission (without involvement in its content, structure, or circle of addressees).

To benefit from the exemption, the provider of a mere conduit service may not initiate the transfer, may not select the recipient of the data, and may not delete or modify the data subject to the transfer.⁴⁴ These conditions must be cumulative. Such a construct is modelled on the exclusion of the courier’s responsibility for the content of the letters and parcels he or she delivers. In addition, the Polish legislators, in Article 12(2) of the PSEMA, have also extended the exclusion of liability to the automatic and short-term indirect storage of transmitted data, if this action is exclusively aimed at carrying out the transmission, and the data are not stored longer than it is normally necessary to carry out the transmission.

A mere conduit service should be neutral, consisting of a purely technical delivery (with no knowledge of the information being transmitted or stored) and a lack of cooperation with the recipient which would have involved transmitting illegal content.⁴⁵

The Polish legislators have not implemented the solution resulting from Article 12(3) of the E-Commerce Directive, which allows for the possibility of imposing an obligation on the provider of mere conduit services, by courts or administrative authorities, to stop or prevent an infringement. However, literature sources state that the absence of an appropriate provision does not eliminate the exclusion of prohibitive claims against service providers.⁴⁶

As a result of technological progress, the providers of mere conduit services have begun to use deep packet inspection technology, which provides greater security for data transmission. It also gives the opportunity to monitor data traffic, as well as to personalise advertisements and profile consumers. Polański notes

The use of DPI technology for marketing purposes by providers of a simple message service may be the basis for waiving the exclusion of liability under Article 12 (…) For in order to be able to attach advertising messages to the content downloaded by the recipient of the service, intermediaries must temporarily change the direction of data transmission, i.e. the recipient of data.⁴⁷

Furthermore, service providers using DPI modify the information contained in the message by attaching an advertising message, which affects its integrity. Therefore, it is not possible to justify such an action with a technical service process in order to improve the effectiveness of the message.

Under copyright law, there is a particular form of evasion of liability for infringing digital content by mere conduit service providers. Article 23¹ of the Copyright Law⁴⁸ provides the author’s consent is not required for a temporary reproduction, transient or incidental in nature, that has no independent economic significance and is an integral and essential part of a technological process whose sole purpose is to facilitate: 1) the transmission of a work in an information and communication system between third parties by an intermediary, or 2) the lawful use of the work.

This provision has been transposed from Directive 2001/29/EC. Accordingly, the possibility of transmitting content infringing copyright and related rights under the mere conduit service is permitted if all the following conditions are met: the act is temporary; it is transient or incidental; it is not economically significant; it is an integral and essential part of a technological process; the purpose of the process is to transmit content through an intermediary between third parties or to allow the lawful use of the work. Legal commentators assume that Article 23¹ of the Copyright Law is a special provision of Article 12 of the PSEMA, and is therefore the only basis for evading liability.⁴⁹

6 Caching

The essence of caching is to “automatically and briefly store on an intermediary server someone else’s data, by creating a copy of them, in order for the end user to download it more quickly in the future” (buffering), which reduces the intensity of packet traffic transmitted within the network, which in turn increases network efficiency.⁵⁰

A distinction must be made here between a mere conduit service and a caching service. Mere conduit, like the caching service, is the automatic and short-term indirect storage of transmitted data. It would therefore appear that we are dealing with the same service. The difference is, however, apparent in the purpose of storing data. In the case of caching, it will be to accelerate access to data. In the case of mere conduit, however, the aim is to facilitate data transmission. The difference is also the duration of data storage, which will be shorter in the mere conduit service. The question arises, therefore, as to the temporal scope of the data storage in the caching service. Legal commentators take the position that “no strictly defined storage period for caching data should be introduced and defined by the caching function. In other words, as long as the storage of the data is to facilitate their faster downloading in the future, it must be regarded as caching”.⁵¹ The specification of the time of data storage has a significant impact, because a service aimed at storing information for a longer period of time, e.g. a mirror-caching service (storing the content of entire websites for a longer period of time), will not be exempted from liability.⁵²

In Article 13(1) of the PSEMA, the legislators state

No entity transmitting data and providing automatic and short-term indirect storage of such data in order to expedite their retrieval at the request of another party shall be liable for the data stored if 1) it does not modify the data; 2) it uses recognised and customary information technology for the technical parameters for accessing and updating the data, and 3) it does not interfere with the use of recognised and customary information technology for the collection of information on the use of the collected data.

In addition, (2) lays down an obligation for the service provider to delete the data, or to prevent access to the stored data, without delay, when it becomes aware that the data have been deleted from the initial source of transmission, or access to the data has been prevented, or when a court or other competent authority has ordered for the data to be deleted or access to them prevented. The fulfilment of these conditions cumulatively allows the service provider to avoid liability.

The caching service provider should not modify the stored data, as this can affect their integrity.⁵³ In practice this means that a copy of the data stored on the servers should be consistent with the content of the data on the input server.⁵⁴ The legislators also require the service provider to use recognised and customary information technology for this type of activity, specifying the technical parameters for accessing the data. As legal commentators indicate, “The purpose of this provision is to ensure that a website copied and stored on a proxy server is accessible to users on the same terms and to the same extent as the same website on the input server”.⁵⁵

An important reason for excluding liability is to remove or prevent access to content where the service provider becomes aware that it has been blocked or removed from the input server. or where an order has been received from a court or administrative authority. The question arises as to what is to be understood by the notion of obtaining information. and whether the service provider is obliged to keep track of the original content which is subject to the caching service. From the content of the provision it seems that any information which reaches the service provider is a message. Furthermore, the interpretation used by the legislators leads to the assumption that an entity providing a caching service has an active obligation to monitor the content which is subject to its service.⁵⁶

7 Hosting

Hosting is one of the most popular services provided in the network. Its essence consists of making the resources of an information and communication system (the virtual memory on the server) available by the service provider to another entity in order to keep the data stored by it in those resources.⁵⁷ Legal commentators distinguish between classic and virtual hosting. The former relates to the storage of websites on a remote server of the service provider in order to make them available to network users. Virtual hosting, on the other hand, consists of making available to the users of a given service the disk space of the provider of a classic hosting service.⁵⁸

In accordance with Article 14(1) of the PSEMA,

Anyone who, while making available the resources of an information and communication system for the storage of data by a recipient of a service, is not aware of the unlawful nature of the data, or of any activity relating to them, shall not be liable for the data stored, and shall immediately prevent access to the data if he or she receives official notification, or if he or she obtains reliable information on the unlawful nature of the data, or of any activity relating to them.

The legislators have thus limited the liability of the hosting provider to a situation in which the provider had no knowledge of the unlawfulness of the content stored, or of the activities related to it; in other words, as long as it is not aware that users are publishing illegal content through the provider, it cannot be held liable for possible legal liability (civil, criminal, or administrative). This provision corresponds to the general principle contained in Article 15 of the PSEMA, according to which the service provider is not obliged to filter the data transmitted, stored, or made available by it. However, where it acquires knowledge as a result of an official notice or actual knowledge of the illegality of digital content stored on its servers, this disclaimer of liability shall be removed unless it blocks access to it. Official notification is to be understood here as information provided by an authorised official (court, public prosecutor’s office, police, public administration authority), in an appropriate (official) form, and with due process. It seems problematic to obtain knowledge about the illegality of data from a source such as “actual knowledge”. Legal commentators assume that such information can be obtained by the service provider from third parties or by itself, but in this case it has to check its veracity.⁵⁹ To this end, appropriate notification procedures should be developed, in particular as regards the indication of the minimum data necessary for the verification of the notification, not specified in the PSEMA, with the obligation to create them being passed on to the service providers themselves.⁶⁰ In its judgment of 18 April 2017 the Court of Appeal in Warsaw ruled

The purposive interpretation of Article 14 of the Act on Providing Services by Electronic Means of 2002 indicates that a host provider is not obliged to conduct a detailed investigation to verify whether the information about the unlawful nature of data or activities related to them is reliable. Therefore, a person requesting the prevention of access to the data should supply the host provider with such information on the basis of which the unlawful nature of the data or activities related to it becomes apparent, and leads it to conclude that it has knowledge of the unlawful nature of the data within the meaning of Article 14(1) of the PSEMA.⁶¹

Such an interpretation was also confirmed by the Court of Appeal in Lublin in the judgment of 18 January 2011, which stated

The service provider is not obliged to monitor the network; furthermore, it is not obliged to take steps to implement monitoring software. The only situation which undoubtedly leads to the liability of the service provider is its being aware of the infringement, or of the unlawful nature of the infringement.⁶²

The notification procedure indicated in Article 14(1) of the PSEMA could be included in the procedure for blocking content referred to as Notice-and-Takedown, adopted in US legislation, where the service provider, on becoming aware of the illegality of the content, must immediately block access to it,⁶³ but only in respect of the case in which the service provider has become aware of the illegality of the content on the basis of an official notification, as provided for in Article 14(2) of the PSEMA. In addition, in such a situation, the service provider shall not be liable for any failure to perform or for the inadequate performance of an obligation between it and the content provider.⁶⁴ However, the Polish legislators have gone beyond the American model by introducing, in a parallel manner, the Stay-and-Stay procedure, the essence of which is contained in Article 14(3) of the PSEMA, according to which the service provider is obliged to immediately notify the recipient of the service of its intention to prevent access to illegal content posted by it.⁶⁵ Fulfilling this obligation removes its liability towards the recipient of the service for damage resulting from preventing access to the data.

The exclusions of liability in Article 14(1) to (3) of the PSEMA do not apply if the provider has taken control of the recipient of the service, that is to say, if the provider of the illegal content acts under the authorisation or supervision of the provider.

When an entity providing services by electronic means cannot invoke the exclusions set out in the PSEMA, the general principles of liability contained in particular domains of law shall apply to it. In the case of civil law, as noted by M. Zieliński, “The liability of intermediary service providers is possible on the basis of many tort regulations, based on both the fault and the risk principles”. In view of the subsidiary nature of ISP activity, however, with regard to the storage or transmission of information on behalf of users of their services, their liability as direct perpetrators should always be excluded, on the basis of Article 415 of the Civil Code. Particular importance in this context should be attached to the interpretation of the liability for aiding within the meaning of Article 422 of the Civil Code.⁶⁶ In the case of the infringement of personal rights by statements by anonymous internet users placed on Internet portals, the liability of the administrator (service provider) should be considered on the basis of Article 24 § 1 of the Civil Code. Pursuant to the judgment of the Court of Appeal in Warsaw of 29 November 2018,

The provision of Article 24 § 1 of the Civil Code does not limit its application to direct infringers of personal rights, but covers all the actions of a specific entity which in any way cause or contribute to the infringement of the injured party’s personal rights, or to the aggravation of the infringement of those rights, previously committed by other entities.⁶⁷

As far as the liability of service providers under copyright law is concerned, the Court of Appeal in Kraków ruled on this on 18 September 2017. In accordance with the operative part of the judgment,

An entity participating in the implementation of transfers infringing property copyrights is a co-perpetrator, and co-infringer of other persons’ rights to the works. Thus, the position stating that the manner in which the entity operates makes it unable to be treated as an entity subject to Article 14 of the Act on Providing Services by Electronic Means, but it is simply an entity which also illegally distributes works protected by copyright, is fully justified. If so, the entity cannot invoke Articles 14 and 15 of the Act on Providing Services by Electronic Means, and Article 79 of the Act on Providing Services by Electronic Means should be applied to accept its responsibility.^68,69

8 There Is No Obligation to Filter Content… Or Is There?

The legislators, in Article 15 of the PSEMA, did not impose a general obligation on the providers of mere conduit, caching or hosting services to check the data transmitted, stored, or made available by them. As the Court of Appeal in Warsaw emphasised in one of its rulings,

This excludes the possibility of imposing general data monitoring obligations on these service providers. The assessment that the standard of behaviour and professionalism requires the controller to filter and remove any statements which violate the law, or which might violate the law in an objective manner, without prior notice, cannot be accepted.⁷⁰

Thus, the Polish Act lacks the full implementation of the provision contained in Article 15(1) of the E-Commerce Directive, which additionally provides for the lack of a general obligation to actively seek the facts and circumstances indicating an illegal activity. However, the literature stresses that, despite the lack of the above obligation, the understanding of the provision of Article 15 of the PSEMA should be read in the spirit of the Directive.⁷¹

However, this does not mean a total ban on filtering content, as recital 47 of the directive provides for the possibility of making it compulsory for service providers to filter certain types of content. The possibility of doing so is left to individual Member States to consider. The Polish legislators did not provide for such a possibility in the PSEMA.

In spite of the fact that the E-Commerce Directive, and thus the PSEMA, did not impose a general obligation on service providers to check content, the European Union tried to push through the filtering obligation in the Directive of the European Parliament and of the Council on copyright in the digital single market.⁷² Article 13 of the Directive provided for this.

Information society service providers that store and provide to the public access to large amounts of works or other subject-matter uploaded by their users shall, in cooperation with rightholders, take measures to ensure the functioning of agreements concluded with rightholders for the use of their works or other subject-matter or to prevent the availability on their services of works or other subject-matter identified by rightholders through the cooperation with the service providers. Those measures, such as the use of effective content recognition technologies, shall be appropriate and proportionate. The service providers shall provide rightholders with adequate information on the functioning and the deployment of the measures, as well as, when relevant, adequate reporting on the recognition and use of the works and other subject-matter.

As a result of protests by electronic-service providers and the public, the European Parliament did not adopt the Directive as proposed. However, this did not mean that work on the regulation of a general obligation to filter content in terms of copyright was stopped. Such an obligation was adopted indirectly in Article 17 of the Directive on copyright and related rights in the digital single market.⁷³ Service providers who produce a large number of works protected by copyright available for profit have been obliged to conclude licence agreements with copyright holders. Under the provisions of the Directive, they are legally liable if they make available content published by users for which they have not paid the authors, unless they show that they have made every effort to obtain authorisation; that they have made efforts to block access to unlawful content; and that they have acted promptly on receipt of the notification. Here, the legislators have introduced an economic criterion for service providers and restrictions on their liability. New providers of online content services whose services have been available to the public in the Union for less than three years. and whose annual turnover does not exceed EUR 10 million, may waive their liability if they have made every effort to obtain authorisation and have acted promptly after receiving a relevant reasoned objection in order to block access to the protected works and subject matter covered by the objection, or to remove those works and subject matter from their websites (Article 17(6)).

The EU legislators also imposed an obligation on Member States to enact legislation stipulating

online content-sharing service providers put in place an effective and expeditious complaint and redress mechanism that is available to users of their services in the event of disputes over the disabling of access to, or the removal of, works or other subject matter uploaded by them.

As legal commentators emphasise,

Although the Directive as such does not impose a general obligation of supervision on the owner of the platform in question, it is currently still difficult to determine how they will be able to discharge their responsibility without implementing such a control-and-supervision system, based on intelligent technology for identifying and recognising content.⁷⁴

The directive also provides for exemptions from the service provider’s liability for user-generated content in online content services. The restrictions concern quotations, criticism, review, and the use of illegal content for the purposes of caricature, parody, or pastiche (Article 17(7)).

Poland has not yet implemented the Directive’s provisions in its national legal system.⁷⁵