Poland Media Law Guide

Defamation, Privacy and Data Protection


Sebastian Pabian

Sebastian Pabian

Partner - Baker McKenzie

Radoslaw Nozykowski

Radoslaw Nozykowski

Counsel - Baker McKenzie


Defamation and Privacy Law in Poland

Contributors: Sebastian Pabian (Partner) and Radoslaw Nozykowski (Counsel), Baker McKenzie

Good name (reputation) and privacy are fundamental values that are protected first and foremost by the provisions of the Constitution of the Republic of Poland[1].

Article 47 of the Constitution stipulates that every individual has the right to legal protection of their private and family life, and of their honour and good reputation. In accordance with Article 30 of the Constitution of the Republic of Poland, these values derive from the inherent and inalienable dignity of a person, which is inviolable, and the respect and protection which are upheld by public authorities. The legal consequences of vesting good name and privacy with constitutional importance are extensive, both under civil and criminal law.

Article 23 of the Polish Civil Code[2] stipulates that an individual’s personal rights, which comprise among other things a person’s good name and privacy, are protected under civil law irrespective of the protection provided to them under other regulations. On the basis of Article 43 of the Civil Code, regulations concerning the protection of the personal rights of individuals apply as appropriate to other legal entities, which is of particular importance in relation to protecting the reputation of a company.

Good name, as well as honour and dignity, are also protected under criminal law. The Polish Criminal Code[3] distinguishes two offences against these values, namely defamation (‘zniesławienie’ – Articles 212-215 of the Criminal Code) and insult (‘zniewaga’ – Article 216 of the Criminal Code).

Civil Law

General construction

Polish law recognises that a person’s good name (or, in a similar way, another legal entity’s reputation) may be harmed, in particular, through the following actions:

(a) disseminating untrue information about facts, or so-called ‘descriptive statements’, the truth or otherwise of which may be assessed against objective criteria; and

(b) disseminating incorrect assessments, or so-called ‘evaluative statements’, which because of their nature may not be assessed objectively.

A breach of the right to privacy may take place, in particular, when information on the private life of a private or public person is disclosed to the public and disseminated[4].

Under the Civil Code, the protection of personal rights is firstly pre-emptive. An individual or other legal entity has the right to require the prohibition of actions that threaten their good name or privacy. On the other hand, an individual or other legal entity whose personal rights (e.g. in the form of good name or privacy) have already been violated has the right to advance both non-pecuniary (mainly a claim for public apologies) and pecuniary claims.

The pecuniary claims may take the form of both compensation for actual financial losses caused by violation and/or compensation for intangible matters such as loss of prestige and public trust. The injured party may also claim a specific amount of money to be paid for the benefit of a social organization specified by them. There is no maximum level of financial compensation provided by the law. The role of the case law is to award the amount of compensation which is adjusted to the actual financial and non-financial damage/harm caused by a violation of a personal right.

Burden of Proof

In order to pursue a claim for the protection of a personal right, the claimant must first prove that a personal right has been infringed or is at risk of infringement. The presentation of materials containing statements violating the claimant’s good name or containing information relating to the individual’s private life will generally suffice. When assessing whether a personal right has been, or is likely to be, violated, the court applies objective criteria. Thus, the perception of a given statement or communication by the community as a whole constitutes the decisive factor; the subjective feelings of the party demanding protection are of secondary importance.

For a claim to proceed, the infringement or the conduct giving rise to the risk of infringement also needs to be unlawful, i.e. contrary to the applicable law or to the rules of social co-existence. However, the claimant does not have to prove that this is the case. Under Polish law, infringements of personal rights are presumed to be unlawful, as is conduct giving rise to a risk of violation. Thus, any conduct which breaches personal rights is unlawful, unless the particular circumstances of the case justify such conduct.

Given the presumption of unlawfulness of a breach of a personal right (or of the risk thereof), the burden of proving lawfulness rests on the defendant. However, where compensation is sought the burden of proving that compensation should be awarded rests on the claimant.

Principal defences

Those circumstances in which a violation of a personal right, or the risk thereof, will be lawful include the following:

(a) Where, in the case of descriptive statements (see above), the information published is factually correct. This principle is extended by Article 12 of the Press Law[5], which excuses a journalist from liability even in the case of publication of untrue material provided he applied due care and acted fairly when researching and preparing the article in question and specifically sought to verify the accuracy of the statements that were published.

(b) Where, in the case of evaluative statements (see above) the views expressed are ‘rightful’ or correct. The vagueness of this criterion reflects the necessarily subjective nature of evaluative statements. Generally, evaluative statements are deemed lawful, unless they exceed acceptable limits of relevance and constructive critique.

(c) Where the person or entity which has violated the personal right in question has done so with the aim of protecting a legitimate public interest. An obvious example is the publication of information relating to the acts of public officials. Polish law recognises the society’s right to information, the right to freedom of speech and public debate and seeks to protect actions taken in furtherance of that right. However, when doing this the courts often find themselves attempting to resolve the inherent conflict between these social rights and the rights of individual citizens or other entities to good name and privacy. The Polish Supreme Court and the Constitutional Tribunal have emphasised on several occasions that none of these rights are absolute; they each deserve to be protected, but they are each also subject to proportionate and justified restrictions as set out in law. The ruling of the Supreme Court dated 24 January 2008 is of particular significance in this context. Not only does it stress the mutually restrictive effect of the right to good name and privacy and the right to freedom of speech, but it also points out that:

‘When searching for appropriate relations between the right to information and the freedom of speech on the one hand, and the right to privacy on the other, one cannot rely on Anglo-Saxon solutions that clearly give priority to the former values, since the scope of the right to freedom of speech should be considered taking into account tradition and the sense of tolerance in a given society’[6].

(d) Where the individual or legal entity whose personal rights have been breached has consented to the action which constitutes the infringement.

Limitation period

As far as limitation is concerned, non-pecuniary claims for the protection of personal rights do not become time-barred under Polish law. Pecuniary claims, on the other hand, do become time-barred three years after the day on which the injured party became aware, or, having acted with due diligence, could have become aware both of the damage or harm caused and of the party responsible for it. This three-year period is subject to a backstop period of ten years from the date the infringement occurred.

Where the damage or harm arises as a result of a criminal offence, a claim can be brought at any time within 20 years from the date the offence was committed, regardless of when the injured party found out about the damage or harm and the identity of the person responsible for it. Furthermore, in case of personal injury the limitation period cannot expire earlier than three years after the injured party became aware of the damage or harm caused and of the party responsible for it, regardless of the backstop dates indicated above.

Criminal Law

Articles 212-215 of the Polish Criminal Code regulate the criminal offence of defamation (‘zniesławienie’) and provide that an offence is committed where a party imputes to another individual, group of individuals, institution, legal entity or unincorporated association, conduct or properties that may publicly humiliate them or expose them to the risk of losing the trust necessary for the performance of a given office, profession or other type of activity. In order for the offence to be committed, it must be established that the perpetrator’s actions were intentional, i.e. that the perpetrator intended to commit an offence, or, anticipating that an offence may be committed, consented to it.

Defamation, defined in Article 212 of the Criminal Code, is punishable by a fine or restriction upon the perpetrator’s freedom. If the offence is committed using mass media (such as television, radio or the Internet) the perpetrator is liable to a fine, restriction of freedom or imprisonment for up to one year. In addition, the court may award a supplementary payment (‘nawiązka’) for the benefit of the injured party, or the Polish Red Cross, or another social or charitable entity specified by the injured party. At the request of the injured party, the court may also order the judgement to be released to the public.

There have been very intense discussions recently about eliminating Article 212 from the Criminal Code, as it was very often used as a tool in political battles. However, no changes have yet been made.

Article 213 §1 of the Criminal Code stipulates that defamation will not be characterised if a non-public allegation is true. With respect to a public allegation, however, ‘evidence of truth’ does not of itself provide a defence. Under Article 213 S2 of the Criminal Code, it must additionally be proven that a true allegation was made in order to protect a legitimate social interest or concerned the conduct of a person performing public functions.

The Polish Constitutional Tribunal has on more than one occasion addressed the question of the compatibility of the offence of defamation with constitutional guarantees of the right to information, freedom of press and freedom of speech. The Tribunal has confirmed that freedom of speech is not an absolute value and is not protected above other constitutional values, such as the honour, good name and dignity of a person. The Tribunal has asserted that:

‘the strict relation between honour and good name on the one hand, and human dignity on the other, argues in favour of covering the issues of violating honour and good name with criminal law regulations. The latter [dignity] is a fundamental value of legal order. Thus, interfering with human dignity is such a significant violation of the foundations of this order that it is no longer the interested parties’ individual issue. Regulating defamation as an offence means that the legislator generally believes that this act is harmful to the public, and therefore it constitutes a violation of the common good rather than a ‘pure’ violation of rights. From this perspective, the application of criminal sanctions for defamation is justified by the intention to emphasise that the State also assesses a violation of good name and honour negatively. The introduction of a criminal sanction is therefore a fundamental form of expressing social condemnation for the perpetrator of the violation of a right.[7]

Regulations regarding the criminal offence of defamation are aimed at protecting a person’s honour and good name.  On the other hand, regulations regarding the criminal offence of insult (Article 216 of the Criminal Code) are aimed at protecting human dignity. A fundamental difference between these two offences is thus that Article 216 of the Criminal Code protects only individuals.

Insult (‘zniewaga’) is represented by such conduct as, according to culturally determined and commonly adopted values, constitutes an expression of contempt for another individual. Insults may take the form of words, gestures, written statements or drawings. Objective criteria determine whether a given statement is an insult, and not the feelings of either the insulting or the insulted party. As with defamation, the offence of insult can only be committed intentionally.

Under Article 216 of the Criminal Code, whoever insults another person in his presence, or publicly in his absence but intending for the insult to reach the other person, shall be subject to a fine or restriction of freedom. If an insult is committed using the mass media, the perpetrator shall be subject to a fine, restriction of freedom, or imprisonment for up to one year. In the latter case, the court may also award a supplementary payment for the benefit of the injured party, or the Polish Red Cross, or another social or charitable entity specified by the injured party.

The court may waive all penalties, even when an offence is found to have been committed, if the insult was caused by the provocative conduct of the injured party or if the injured party responded in turn with a breach of personal inviolability or with a reciprocal insult.

Prosecution of the offences of defamation and insult will only arise following the making of a complaint by the injured party. The injured party must submit an indictment themselves and thereafter collect and present all relevant evidence.

The offences set out in Articles 212-216 of the Criminal Court cannot be instigated before the court later than one year following the day on which the injured party became aware of the perpetrator, but in any case no later than three years after the offence was committed.


Among other elements of Polish law relating to the protection of good name, the provisions of the Press Law regarding the provision of a correction is worthy of note.

Where requested by an interested party, the editor of a daily publication or a periodical is obliged, by Article 31a of the Press Law, to publish, free of charge, a concise factual correction regarding untrue or inaccurate information.  Both the form of the correction, and the detailed prerequisites for its publication, are defined in the Press Law.

Personal Data Protection

The protection of personal rights is closely related to the protection of personal data, since many defamation cases involve the processing of the complainant’s personal data. The rules on personal data processing are mainly described in the General Data Protection Regulation (“GDPR”)[8] and in local supplementing acts.

Personal data are defined as any information relating to an identified or identifiable natural person (so called “data subject”). An identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person.

In practice in many defamation cases, various personal data are processed (it must be noted, however, that such processing does not automatically create personal data processing liability), since defamation usually takes advantage of knowledge of various information about a particular person. This is because processing means any operation or set of operations which is performed on personal data or on sets of personal data, whether or not by automated means, such as collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or even destruction.

The GDPR requires that personal data shall be:

(a) processed lawfully, fairly and in a transparent manner in relation to the data subject;

(b) collected for specified, explicit and legitimate purposes and not further processed in a manner that is incompatible with those purposes;

(c) adequate, relevant and limited to what is necessary in relation to the purposes for which they are processed;

(d) accurate and, where necessary, kept up to date; every reasonable step must be taken to ensure that personal data that are inaccurate, having regard to the purposes for which they are processed, are erased or rectified without delay;

(e) kept in a form which permits identification of data subjects for no longer than is necessary for the purposes for which the personal data are processed;

(f) processed in a manner that ensures appropriate security of the personal data, including protection against unauthorised or unlawful processing and against accidental loss, destruction or damage, using appropriate technical or organisational measures.

The above rules are specified in a very comprehensive manner by the GDPR and they are binding for so-called data controllers, who can be held accountable for incompliance in this area. A data controller is a person/entity which determines the purposes and means of the processing of personal data. In practice the person committing defamation will also usually be the data controller of the data of the person in question. Consequently, he/she might be held liable for any failure to comply with data protection rules – in particular due to illegal processing such as the use or disclosure of such data, contrary to the rules of the GDPR.

Such lack of compliance may lead to following types of liability:

(a) administrative (Article 83 of the GDPR): high penalties – even up to EUR 20m or 4% of the global turnover of the data controller – which can be imposed by the relevant data protection authority;

(b) civil (Article 82 of the GDPR and relevant provisions of the Civil Code): compensation from the data controller that can be sought in the civil court – in a similar way to that relating to a claim for compensation for breach of an individual’s personal rights;

(c) criminal (Article 107 of the Law on personal data protection[9]): Polish law provides that processing of personal data without a legal basis is a criminal offence, which is subject to imprisonment of up to three years (in case of so-called sensitive data – such as e.g. data on vices or health), in addition to a fine or restriction upon the perpetrator’s freedom.

It is important to be aware that even using false (incorrect) personal data (a fairly typical occurrence in defamation cases) may generate liability under the GDPR.

Contributors: Sebastian Pabian (Partner) and Radoslaw Nozykowski (Counsel)

Baker McKenzie
Rondo ONZ 1
Warsaw 00-124

The material in this Guide is for general information only and does not constitute legal advice.

[1] The Constitution of the Republic of Poland dated 2 April 2007, Journal of Laws of 1997, No 78, item 483, as amended
[2] The Civil Code dated 23 April 1964, Journal of Laws of 2019, item 145
[3] The Criminal Code dated 6 June 1997, Journal of Laws of 2019, item 1950, as amended
[4] Article 14 section 6 of the Press Law dated 26 January 1984 prohibits the publication of information and data concerning the private sphere of life without the consent of the interested party, unless the material in question is directly related to the public activities of that party
[5] The Press Law dated 26 January 1984, Journal of Laws of 2018, item 1914
[6] Ruling of the Supreme Court dated 24 January 2008, I CSK 341/07, Bulletin of the Supreme Court 6/2008, item 14
[7] Judgment of the Constitutional Tribunal dated 30 October 2006, P 10/06, Journal of Laws of 2006, No 202, item 1492.
[8] Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation), Official Journal of the European Union L 119/1
[9] Law on personal data protection dated 10 May 2018, Journal of Laws of 2018, item 1000, as amended

Our Newsletter