How to identify an infringer?

Establishing the identity of an anonymous infringer is the biggest obstacle to the effective pursuit of claims concerning infringement of personal rights on the Internet. Theoretically, it is possible to request the network operator to provide the IP number of the specific user, however the request can often be refused due to the protection of the confidentiality of correspondence and personal data.

It results from the wording of art. 18(6) of the Act of 2002 on the provision of electronic services that there is an obligation to provide information on data only to state authorities for the purposes of their investigations. However, this does not mean that disclosure of these data whose rights have been infringed is prohibited. Therefore, prosecuting bodies in the event of initiation of preparatory proceedings have a greater chance of finding infringer. However, not every infringement of personal rights or principles of fair competition will result in criminal liability.

Therefore, provisions on the protection of personal data apply in this respect. Administrative courts have previously held the view that “the secret of communication in the telecommunications networks reaches only to the borders of the collision with the applicable legal order, and where there is a suspicion of contradiction with that order, this rule must be surrendered before a higher good (judgment of the Supreme Administrative Court of 21 February , file no I OSK 2324/12).

Therefore, it is assumed that there is no basis, pursuant to the provisions on the protection of personal data, for the provision regarding the obligation to disclose operational data to state authorities for the purpose of specific proceedings to be treated as excluding the possibility of disclosing such data to other persons.

In order to obtain data in the form of the computer’s IP, it is necessary therefore to refer to the necessary interest in the form of pursuing claims for infringement of personal rights or committing an act of unfair competition.

What is important, the Supreme Administrative Court accepts that it is not necessary to file a lawsuit or to direct a private indictment (judgment of the Supreme Administrative Court of 4 December 2014, file no I OSK 978/13). it is obvious that in any case –in the case of filing a lawsuit as well as in the case of a non-judicial claim, it is necessary to identify the addressee of the claim.

In practice, obtaining data necessary to identify the case is still significantly impeded, and since the general regulation on data protection (GDPR) is in effect, it should be observed how the practice of sharing these data and the intervention of the President of the Office for Personal Data Protection in case of refusal to disclose them will form.