Cybersecurity regulations

A crowdfunding platform may be regarded as an “online commercial platform” within the meaning of the National Cybersecurity System Act of 5 July 2018. Under that act, such a platform is defined as “a service enabling consumers or businesses to conclude contracts by electronic means with businesses on a website of a commercial platform or on the website of a business that uses services provided by an online commercial platform.”

Many crowdfunding platforms have this characteristic; that is, they enable conclusion of contracts by electronic means on the website of the platform or of a business that uses the platform’s services. Within the meaning of that regulation, such platforms will be digital service providers, on whom certain cybersecurity obligations are imposed. This primarily means the need to implement technical and organisational measures ensuring security, including proper handling of cyber incidents. Failure to comply with obligations under the act is threatened with financial penalties.

But here it is important to stress an exception provided for in that act which is important in practice. Namely, the act exempts from these obligations micro enterprises and small enterprises within the meaning of the Business Law of 6 March 2018. This means that in practice, the great majority of crowdfunding platforms currently operating in Poland will probably not be subject to those regulations. It cannot be ruled out, however, that in the future, along with growth in the crowdfunding market, platforms will arise that can no longer rely on that exception and will have to comply with the obligations under that act.

Geoblocking

The EU’s Geoblocking Regulation (2018/302) entered into force from December 2018. It is intended to prevent differentiation within the EU in conditions for access to goods or services due to nationality, place of residence, or place of establishment.

Some online platforms may be covered by this regulation, as it essentially applies to any entity operating for business purposes, including an entity providing services by electronic means. At the same time, the regulation does not apply to certain types of activity (such as financial services). Thus it cannot be excluded that some platforms will have to comply with the prohibitions set forth in that regulation.

Crowdfunding platforms that are subject to the regulation cannot block or limit a customer’s access to its online interface due to the origin of the platform’s users. As a rule, it also cannot apply different conditions for access to the platform on the same grounds.

P2B Regulation

Another act of EU law that may affect the operation of crowdfunding platforms is Regulation (EU) 2019/1150 of the European Parliament and of the Council of 20 June 2019 on promoting fairness and transparency for business users of online intermediation services—also known as the Platform to Business (P2B) Regulation. This is a new regulation entering into force on 12 July 2020.

The main aim of the P2B Regulation is to protect users of online platforms against anti-competitive practices. Experiences with some platforms have shown that their nearly monopolistic position can be very hazardous to the health of numerous smaller entities operating in the field of e-commerce.

Although this regulation is not addressed expressly to crowdfunding platforms, some of them may find themselves within its scope of operation. When can this happen, and what will the consequences be?

Basically, the new rules may cover crowdfunding platforms that “allow business users to offer goods or services to consumers, with a view to facilitating the initiating of direct transactions between those business users and consumers, irrespective of where those transactions are ultimately concluded.” Under the regulation, a “business user” is defined as “any private individual acting in a commercial or professional capacity who, or any legal person which, through online intermediation services offers goods or services to consumers for purposes relating to its trade, business, craft or profession.”

Any crowdfunding platform that brings together consumers and business users should carefully examine the profile of its business users and the nature of the legal relations created within the platform to determine whether the regulation will apply to it. If it does, the platform will qualify as a “provider of online intermediation services” for purposes of the P2B Regulation.

In practice, this will mean a necessity to frame the platform’s terms and conditions appropriately and to include there a number of provisions arising under the regulation. This will reduce the freedom of framing the terms and conditions of platforms (e.g. with respect to rules for amending the terms of services or terminating contracts with users). Platforms will also have to increase the transparency of their operations, among other things by providing information on the parameters for rankings and disclosing the rules for differentiated treatment of goods and services offered on the platform. The terms and conditions will also have to contain transparent provisions on the data generated within the platform, e.g. data concerning the interest in specific offers (such as who has access to them, whom they are shown to, etc).

Krzysztof Wojdyło