Today, on 27 October 2022, the Digital Services Act (“DSA”) was published in the Official Journal of the European Union (see here). Complementing the competition focused Digital Markets Act which itself was only recently published on 12 October 2022, the DSA represents another building block in the strategy of the European Commission ("Commission") to more comprehensively regulate the digital space and strike a balance between the protection of recipients and the competitiveness of the EU market.
As we have previously laid out in more detail, the DSA specifically targets major technology companies in the form of “very large online platforms” or “very large online search engines” with at least 45 million monthly active recipients, imposing on them detailed organizational and procedural obligations to react to and combat illegal online content in a transparent manner.
While the DSA largely preserves the liability principles applicable to so called providers of intermediary services – involving the transmission, caching or hosting of information via communications networks to recipients in the EU (extraterritorial application) – established by the e-Commerce Directive of 2000, the DSA goes much further than the Directive, introducing a basic transparency regime which will apply to all such providers of intermediary services. Hence, the DSA’s material scope may extend well beyond “typical” intermediary service providers like social media or content platforms.
Hosting service providers will be required to put in place so-called notice and action mechanisms that allow third parties to notify the provider of illegal content in an easily accessible and user-friendly way. The moderation of such content will need to be documented and justified in a transparent manner.
From online platforms other than micro and small enterprises, the DSA further requires a sophisticated internal complaint-handling system for user complaints. Where online platforms allow for consumers to conclude distance contracts with traders, they must comply with certain KYBC-style obligations ensure that such traders are traceable, and set-up their user interface to enable traders to comply with their own transparency obligations (so-called compliance by design).
Restrictions on certain targeted advertising practices, in particular regarding minors, the use of sensitive personal data and so-called “black pattern practices” such as nudging, will likely have an impact even beyond the material scope of the DSA, as data protection supervisory authorities will likely seize on this legal development to bolster their own enforcement efforts directed at all actors in the advertising space.
The DSA will enter into force on the twentieth day following its publication, i.e. on 16 November 2022, and will apply from 17 February 2024. However, the DSA may apply even sooner to “very large online platforms” and “very large online search engines”, namely from four months after they have been notified that they have been so designated by the Commission.
While the Commission will now be setting out to prepare its designation of “very large online platforms” and “very large online search engines”, the EU Member States will first have to decide whether they will designate existing authorities as enforcement authorities under the DSA (the so-called Digital Services Coordinators) or set up new authorities for this purpose. In some states like Germany and France, data protection supervisory authorities have already voiced their interest to take on the mantle of Digital Services Coordinators, as well.
Violations of the DSA can result in significant fines up to a maximum of 6% of total worldwide annual turnover, exceeding even the maximum fines under the General Data Protection Regulation ("GDPR"). Under the right of complaint set out in the DSA, an increase in claims raised by individuals/consumers as well as consumer protection bodies is also likely, especially given recent jurisprudence regarding the parallel provision in the GDPR and the impending transposition of the EU Directive on representative actions in many EU Member States. Moreover, the agreed version of the DSA has introduced a new right to compensation for recipients of intermediary services against damage or loss suffered due to an infringement of a provider of its obligations under the DSA.
Companies providing digital services would therefore be prudent to use the remaining time to review whether they fall under the broad scope of the DSA and, if so, begin adapting and/or supplementing their technical and organizational set-up to be ready for compliance with the DSA by 17 February 2024 (or sooner in the case of very large online platforms and search engines).
Forward