The Legal Situation of Operators of Essential Services and Digital Service Providers in the Provisions of the Act of 5 July 2018 on the National Cybersecurity System

Abstract

The Act of 5 July 2018 on the National Cybersecurity System and its accompanying executive regulations have introduced into Polish law the provisions of the Directive of the European Parliament and of the Council of 6 July 2016 concerning measures for a high common level of security of network and information systems across the Union (UE) 2016/1148. The fundamental reason for these regulations was to establish a coherent system to ensure the cyber security of the Republic of Poland with accordance to standards adopted for European Union Member States. This paper presents the legal situation of operators of essential services and digital service providers that was created by the provisions of the ANCS. The ANCS not only identifies operators of essential services, digital service providers, and their assigned obligations, but also addresses the competent authorities’ tasks of supervising, inspecting and imposing penalties within the cyber security system. The findings, assessments and conclusions presented here are based on the interpretation of the provisions of the ANCS and are supported by prominent claims of academic representatives. The analyses contained within this paper aim to show that despite the comprehensible and contemporary ratio legis – which falls within the framework of pursuing the state of digital safety – the provisions of the ANCS require adjustments that acknowledge the legal situation of operators of essential services and digital service providers.