The rapid expansion of cloud computing services presents new problems concerning compliance with certain legal requirements, especially in the banking sector.

Generally applicable polish law, which is presumed to be neutral from the technological point of view, does not directly regulate cloud computing as such. Despite this, regulatory restrictions on the outsourcing chain could be an obstacle to use of cloud computing services in the banking sector. This obstacle could be removed in the near future.

Use of cloud computing technology could pose a major challenge for firms for which there is a limit under currently applicable law with regard to the number of subcontractors they can use in the outsourcing chain. Outsourcing is regulated in various ways across the different legal regimes concerning the operations of particular categories of regulated entities. Banks in particular are subject to significant restrictions in this regard. Under current laws, banks can only outsource to one degree. Credit unions, for example, are also subject to significant restrictions, as there are no laws allowing them to subcontract.

A recently published bill proposing amendments to ensure growth of the financial market and protect investors on that market includes a plan to amend the Banking Law of 29 August 1997 (Journal of Laws of 2020, item 1896 as amended). The amendments could have major implications for use of cloud computing by firms in the banking sector.

An analysis of the consequences of the legislation provided with the proposal revealed that the envisaged changes are intended for instance to put into order and streamline the functioning of financial market institutions, in particular with regard to eliminating barriers to the financial market, making monitoring of the financial market more effective, protecting financial institutions’ customers, and harmonizing the legal instruments for protecting and disclosing legally protected secrets, by amending the laws on the financial market.

From the point of view of cloud computing service providers, who are able to make use of many types of specialized subcontractors, the envisaged liberalization of the approach to the outsourcing chain is a major development. At the same time, this is an opportunity to resolve definitively issues concerning whether it is permitted to create further outsourcing levels, for which essentially there are no legal limitations, for activities outsourced to third-party firms or foreign firms as defined in the law. The solutions proposed in this respect will be very important as regards broad use of cloud computing services in the banking sector.

Co-author: Henryk Hoser