Online hate in Poland – how to secure evidence and identify the author

Online attacks often feel chaotic – false reviews, defamatory posts, anonymous threats, manipulated screenshots, coordinated harassment. The legal response should be structured. The first step is preserving evidence before it disappears. Polish law provides multiple parallel paths: civil personal rights protection, criminal defamation/stalking, GDPR right to erasure, and the EU Digital Services Act applicable from 17 February 2024.

The firm is based in Poznań and assists clients throughout Poland, both in person and remotely by telephone or video call.

→ What this guide covers

1. 01Evidence preservation – first 48 hours
2. 02Legal classification
3. 03Identifying anonymous authors
4. 04Removal strategies
5. 05Compensation amounts
6. 06Doxing and personal data exposure

01. Evidence preservation – first 48 hours

Most common mistake is delay. Posts get deleted, accounts disappear, platform data ages out. Useful evidence:

• Full URLs with timestamps (not just screenshots);
• Profile data – username, display name, profile photo, account creation date if visible;
• Comments and replies – full thread context;
• Private messages – exported with metadata where possible;
• Platform notifications, push notifications;
• Witness statements – others who saw before deletion;
• Archive copies – Wayback Machine, archive.today;
• Notarial certification (protokół notarialny) – strongest evidence, costs 200–500 PLN per page certified.

For serious matters, consider digital forensics expert (1,500–5,000 PLN) for proper chain of custody. Critical: do not engage perpetrator publicly during evidence collection – your responses become evidence.

02. Legal classification

Same post can violate multiple laws:

Personal rights (Articles 23–24 and 448 of the Civil Code): broad protection of personal rights, including non-monetary remedies such as cessation/removal of effects and, where statutory conditions are met, monetary claims. Non-monetary claims are not subject to a blanket three-year limitation period; limitation applies to monetary claims according to their legal basis.

Criminal defamation (Article 212 of the Criminal Code (KK)): statements capable of lowering reputation; §1 provides a fine or restriction of liberty, while mass-media defamation under §2 may additionally be punished by imprisonment for up to 1 year; private prosecution;

Insult (Article 216 CC): offensive expressions; fine or restriction of liberty; private prosecution.

Stalking (Article 190a of the Criminal Code (KK)): stalking/identity misuse under §§1–2 is punishable by 6 months to 8 years and is prosecuted on the victim's motion; the limitation period is not 5 years and, for an offence punishable by more than 5 years, is generally 15 years under Article 101 KK, subject to Article 102.

Threats (Article 190 of the Criminal Code (KK)): a criminal threat is punishable by imprisonment for up to 3 years and is prosecuted on the victim's motion.

Identity theft (Article 190a § 2 of the Criminal Code (KK)): identity misuse is punishable by 6 months to 8 years and is prosecuted on the victim's motion.

Distribution of intimate images (Article 191a CC): up to 5 years.

Hate speech (Article 257 CC): racial/religious/ethnic insults; up to 3 years.

03. Identifying anonymous authors

Process requires proper sequencing:

1. Platform-direct request – most platforms have notice-and-action; effective for content removal but rarely for identification;
2. Criminal proceedings – police and prosecutors have authority under Article 218 CCP to demand subscriber data; telecom operators must provide IP information;
3. Civil court motion for evidence (Article 248 CPC) – for online intermediaries, DSA Article 10 concerns orders to provide information about specific recipients of a service; Article 9 concerns orders to act against illegal content;
4. Cross-border – for EU-establishment platforms (Meta, X, TikTok in Ireland), Polish court orders enforceable across EU; for US-based platforms, MLAT requests via Polish Ministry of Justice.

Realistic expectations: identification successful in 30–50% of cases involving major Western platforms with proper procedural approach. Lower for non-cooperative jurisdictions or platforms outside EU. Original IP information typically retained 6–12 months – speed matters.

04. Removal strategies

Multiple parallel paths:

• Platform notice-and-action (DSA notice-and-action rules, including Article 16) – providers must process notices in a timely, diligent, non-arbitrary and objective manner; the DSA does not impose a universal statutory 24-hour-to-7-day deadline for every notice;
• GDPR right to erasure (Article 17) – controller must respond within 1 month; enforceable through Polish DPA (UODO);
• Court interim injunction (zabezpieczenie roszczenia) – Polish courts can order removal within 1–4 weeks; court fee 100–300 PLN; particularly effective for ongoing harm;
• Settlement with author – once identified, a direct demand may lead to settlement; a court settlement is an enforcement title, while a notarial deed is directly enforceable only if it meets the requirements of Article 777 CPC, including the required submission to enforcement where applicable.

For Google search results: separate "right to be forgotten" requests under EU rules. Reduces visibility even when original content remains.

05. Compensation amounts

Polish courts increasingly award substantial compensation:

• Moderate online defamation: 5,000–20,000 PLN;
• Significant attacks (sustained, broader reach): 20,000–80,000 PLN;
• Severe attacks (intimate content, business reputation, identity theft): 80,000–300,000 PLN;
• Egregious cases (deepfakes, coordinated attacks, public figures with provable harm): 300,000+ PLN.

Factors increasing compensation: scope and duration of publication; permanence; provable economic harm; professional/family consequences; defendant's wealth; defendant's conduct after notice (refusing to remove worsens position).

06. Doxing and personal data exposure

Doxing – publication of personal information (address, phone, workplace, family details) – combines violations: personal rights (Article 23 CC); GDPR violation (fines up to EUR 20M or 4% of revenue); stalking (Article 190a CC if persistent); identity theft (Article 190a § 2 CC if data used for harm); disclosure of confidential information (Article 266 CC for some categories).

Doxing requires fast action: police complaint, GDPR complaint to UODO, civil court interim injunction, witness protection if threats involved. Combination typically achieves removal within days.

FAQ Frequently asked questions

∎ Summary and next steps

Polish law provides comprehensive framework for online hate cases – combining civil personal rights protection, criminal defamation/stalking, GDPR right to erasure, and EU Digital Services Act. Success depends on early evidence preservation, choosing the right procedural path, and persistent execution across parallel tracks.