The President of Poland’s Personal Data Protection Office has welcomed the Ministry of Digital Affairs’ decision to incorporate some of the comments previously submitted on the draft legislation implementing the Digital Services Act in Poland.
At the same time, the regulator is maintaining its remaining proposals, including expanding the list of offences covered by the fast-track content removal procedure, allowing decisions to be enforced immediately in the most serious cases and strengthening privacy protection, particularly against illegal deepfakes.
On 17 June 2026, the government’s draft amendment to the Act on Providing Services by Electronic Means was referred to the Polish parliament’s Committee on Digitalisation, Innovation and Modern Technologies. Its purpose is to establish national mechanisms for applying the EU Digital Services Act, commonly known as the DSA.
Among other measures, the bill introduces a procedure for issuing orders requiring action against illegal content published online. It is also intended to make it possible to order the restoration of access to materials that have been removed without sufficient grounds by an online service provider.
The proposed solutions have nevertheless generated controversy. On the one hand, there is an increasingly urgent need to remove content that violates the law and the rights of victims. On the other, any administrative procedure for blocking online material raises concerns about restrictions on freedom of expression, the risk of abuse and the possible introduction of mechanisms resembling censorship.
Ministry Accepts Some of UODO’s Comments
The Ministry of Digital Affairs conducted extensive public consultations on the draft legislation. Poland’s Personal Data Protection Office, known as UODO, also participated and submitted proposals relating primarily to privacy protection and the rules governing the processing of personal data.
Some of UODO’s comments were incorporated into a revised version of the bill. The provisions governing the processing of data relating to people involved in proceedings concerning orders to act against illegal content were clarified.
The bill also states that decisions published on the websites of the competent authorities, which are expected to include the Office of Electronic Communications and the National Broadcasting Council, will not contain personal data.
However, according to UODO President Mirosław Wróblewski, the remaining proposals still need to be addressed. Because they concern fundamental principles of data protection and privacy, he sent another letter to the Ministry of Digital Affairs and subsequently submitted a similar position to the parliamentary Committee on Digitalisation, Innovation and Modern Technologies.
UODO Seeks a Broader Definition of Illegal Content
One of the regulator’s most important proposals is to expand the list of offences that would allow the accelerated procedure for restricting access to online content to be used.
The current version of the bill contains a narrowly defined list of such offences. Three principal criteria were used in drawing it up. The act must be an online offence committed through the use of the internet. It must involve the dissemination of content that can be considered illegal. At the same time, restricting access to the material should not have a negative impact on public debate, civic discourse or electoral processes.
UODO argues that the list should also include offences involving the dissemination, recording, possession and processing of pornographic content involving minors or using their image. These offences are covered by Article 202, paragraphs 3 to 4c, of the Polish Criminal Code.
The authority stresses that the inability to block such material quickly may have irreversible consequences for victims. The circulation of intimate images of children or material using their likeness may trigger severe psychological crises and, in extreme cases, even lead to suicide attempts.
Publication of Stolen Data Should Also Be Covered
The President of UODO has also proposed extending the new rules to offences covered by Article 107 of the Personal Data Protection Act and Article 54 of the Act on the Protection of Personal Data Processed in Connection with the Prevention and Combating of Crime.
These provisions impose criminal liability for processing personal data when such processing is unlawful or when the person concerned is not authorised to carry it out.
In practice, the accelerated procedure could therefore apply to content containing data stolen in a cyberattack, information identifying victims or suspected perpetrators of crimes, as well as addresses, telephone numbers, documents and other personal information published without a lawful basis.
As Mirosław Wróblewski noted, such offences may create a serious risk that the data will be exploited further, unlawfully processed again, published or transmitted via the internet.
In the regulator’s view, both offences satisfy the criteria adopted by the authors of the bill. They are committed using the internet, involve the dissemination of illegal content, and their removal should not threaten public debate or democratic processes.
Immediate Enforcement in the Most Serious Cases
The second key proposal is to allow certain content removal decisions to be declared immediately enforceable.
The current version of the bill does not provide for such a mechanism. This is intended to ensure effective judicial review and reduce the risk of interference with freedom of expression before a case has been finally resolved.
The President of UODO nevertheless believes that decisions should take immediate effect where the most serious threats are involved. This option would be used only exceptionally, primarily in cases involving children and young people, sexual exploitation and the distribution of material violating the privacy of minors.
According to UODO, leaving such material online for days or weeks may cause harm that cannot later be reversed. During that time, the content can be copied, shared on other platforms and distributed to an ever-growing audience.
Particular risks arise from material generated or altered using deepfake technology. Fabricated nude images, videos or recordings depicting children may be circulated through social media, messaging services and closed online groups, causing severe distress, helplessness and serious psychological crises among victims.
Illegal Deepfakes Require More Effective Regulation
The final major proposal concerns ensuring that the planned provisions are consistent with other regulations relating to new technologies and cyberspace.
In particular, UODO wants mechanisms that make it possible to combat illegal deepfakes, unlawful use of a person’s image and other forms of privacy violation and personal data processing carried out without the individual’s consent.
Technology capable of generating realistic images, voice recordings and video content is developing rapidly. It is becoming increasingly easy to create false material showing a specific person in a situation that never occurred.
The problem is not limited to political disinformation or financial fraud. Deepfakes can also be used to blackmail, humiliate and sexualise specific people, including children and young people. In such cases, personal data protection is directly linked to the protection of dignity, mental health and personal safety.
Victims May Be Left Without Adequate Protection
According to the President of UODO, leaving the bill in its current form may result in some victims being unable to use the accelerated mechanism for removing harmful material.
This could apply, for example, to unlawfully published information identifying a victim of rape, child sexual abuse or another serious criminal offence. The victim’s name, home address, photographs, contact details or other identifying information could remain available online.
Such data could then be copied and used for harassment, threats, blackmail or further distribution. As a result, the harm caused by the original publication could be multiplied many times over.
UODO stresses that quickly restricting access to such content is one of the most important tools available for protecting people whose privacy has been violated.
DSA Legislation Offers an Opportunity for Comprehensive Protection
Mirosław Wróblewski has acknowledged the urgent need to adopt legislation enabling the Digital Services Act to be fully applied in Poland.
At the same time, he believes that work on the bill represents the best opportunity to introduce solutions into Polish law that would make it possible to respond more effectively to threats affecting people who require special protection from the state.
This applies particularly to children, young people, victims of sexual offences, people at risk of having their personal data disclosed and those harmed by the unlawful use of their image.
The President of UODO has asked the parliamentary Committee on Digitalisation, Innovation and Modern Technologies to consider supplementing the bill in the areas identified by the authority.
According to UODO, the proposed changes would not require a fundamental redesign of the legislation. At the same time, retaining judicial oversight of the decisions should reduce the risk of the procedure being misused in cases where no criminal offence has occurred.
The proposal to allow decisions to be made immediately enforceable had previously also received support from the Ministry of Education.
In the view of the President of UODO, adopting the proposed measures would provide more effective protection for individuals, especially the youngest internet users, against violations of personal data, privacy and image rights.
This is particularly important at a time when new technologies make it possible to create and distribute harmful content faster than ever before.
