Blanket Surveillance Act

February 7, 2016 was the effective date for the Act of January 15, 2016 on Amendments to the Police Act and Certain Other Acts (Journal of Laws of 2016, item 147), generally known as the "Blanket Surveillance Act". It introduced essential amendments to the operation of the uniformed services1, including operational surveillance procedures, and the services' ability to collate data from telecom, postal and e-service operators.

As you are very likely to use the services of any of the above companies, or may actually be classified as one of them, please take some time to read the most important amendments.

Most important amendments

The uniformed services will now be able to obtain data2 which is not part of a postal message or telecom transmission and data other than the content of an e-service, and their use of this operating technique will only be checked post facto by regional courts. Telecom companies, postal operators and e-service providers will be required to provide the data referred above free of charge, including by means of a fixed connection. New rules for handing over data containing or likely to contain client-attorney privileged content, with the proviso that investigators will be able to read all the content obtained with the use of their operating techniques before the court approves the use of this information in the investigation. Operational surveillance may take up to 18 months. Risk areas

The vast scope of data which may be secretly accessed by the uniformed services considerably impairs everyone's ability to protect private or confidential information, including legally privileged secrets. The amendments provide that the uniformed services will now have a right to obtain and record, e.g.: Correspondence, including emails3: this category may include correspondence sent by means of computer applications (e.g. mobile) and certain internet portal functionalities (chat); Data stored on IT systems4 - it is possible that the uniformed services may be authorized to secretly use malware installed on the users' devices to systematically access and download data stored in these systems; Data regarding the use of e-services5 - this notion encompasses the user's full name, PESEL number, residential address, e-mail address, IP address, as well as information on the scope of use of the e-service ("meta-data"), which raises concerns that use of portals, websites and cloud services will be monitored. Considering the broad extent of data...