Since 2009, the Panoptykon Foundation has criticized the Polish data retention law as well as other laws providing for non-targeted surveillance and called for their revision. For their campaign, Panoptykon collected hard evidence (statistical data, personal stories) in order to back up their policy claims. They sought out the scope of government requests for citizens' data in order to educate the general public on the severity of the surveillance problem.

Additionally, Panoptykon, in collaboration with other organizations from the European Digital Rights coalition (EDRi), challenged data retention laws all across Europe. EDRi wrote a shadow report when the European Commission published its own official report summarizing the evaluation of how Data Retention Directive was being implemented. Panoptykon referenced EDRi's report as a source of arguments for Poland. The organization used comparative analysis to show that the implementation of the Data Retention Directive in Poland was practically the worst out of all the member states.

Through an organic process, Panoptykon cultivated relationships—in particular with the media—and positioned themselves as experts on the topic. They spoke at conferences and meetings where they knew journalists and decision makers would be. Panoptykon connected with a journalist who was passionate about their issues and further relayed their message by covering many of their stories. After five years, hundreds of articles had been published about data retention and other aspects and non-targeted surveillance. As a result, more organizations joined the cause. Panoptykon organized meetings, roundtables and conferences that involved people from all sides of the policy spectrum—including representatives of the intelligence agencies. Through this dialogue, the organization learned about the differing opinions regarding data collection and use for security purposes. This understanding turned out to be necessary to convince prosecutors, judges, intelligence community and decision makers that substantive change is needed.

Their campaign yielded results. In 2011, the Polish Ombudsman brought a few cases to the Constitutional Tribunal, claiming that existing legal provisions were unconstitutional. In particular, it criticized Poland's inadequate legal safeguards for citizens. The case is pending. Similar arguments and recommendations were made by the Supreme Audit Office in 2013. As a result the government is under pressure to revise the existing law and increase its checks and balances.

In 2012 the period of retaining telecommunication data was shortened from 24 to 12 months. The revised law also clarified that civil courts cannot use this data (before, telecommunication data were used in, for example, divorce cases). Additionally, the draft law providing for the creation of an external supervisory body is under discussion. While there is still work to be done—with details and modalities still being negotiated—they have come a long way to change the mainstream debate. When Panoptykon started their campaign, data retention was not considered a problem by mainstream commentators and officials. Now even the Polish government and police, secret surveillance, and other important institutions agree there is need for change.