What is the Digital Services Act?

The series on the European Data Strategy now includes an episode on the Digital Services Act (DSA).

What is the DSA?*

The DSA is a European Regulation that aims to ensure a safe, predictable and secure online environment, addressing the distribution of illegal online content and the societal risks that the dissemination of disinformation or other content may pose, effectively protecting fundamental rights and facilitating innovation. On 25 August 2023, the DSA entered into force for major tech companies such as Google, Meta, Amazon, Alibaba, Apple, Booking and Wikimedia.

The DSA provides harmonised rules on the provision of brokering services in the internal market, and in particular:

1. a framework for the conditional liability exemption of brokering service providers;
2. rules on due diligence obligations tailored to certain specific categories of brokering service providers;
3. rules on the implementation and enforcement of this regulation, including on cooperation and coordination between competent authorities.

Very large online platforms represent systemic risks, reason why the DSA has been declared applicable to them first. Think of distribution of illegal content, the infringement of people’s fundamental rights, negative effects on democratic processes and harm to public health. From those risks flow the obligations of online platforms. For the sake of brevity, the nature and extent of systemic risks will not be discussed further.

The DSA makes a distinction according to the nature of the service and attaches conditional exemptions from liability to it. These are ‘mere conduit’, ‘caching’ and ‘hosting’. As these categories suggest, they mainly involve storage and transmission of data for third parties and it makes sense to assume exemption from liability, even if subject to conditions.

So what are those conditions?

One of those conditions for exemption is that the service provider does not have actual knowledge of the illegal activity or illegal content and, in the case of a claim for damages, does not have knowledge of facts or circumstances that clearly show the illegal activity or content. By extension, as soon as the service provider acquires such knowledge or awareness, it must act promptly to remove or prevent access to the illegal content. This condition for exemption does not apply when the recipient of the service is acting under the authority or supervision of the service provider.

Online platforms are further encouraged to be proactive in preventing systemic risks by making it explicit that by doing so, they will not lose the right to the exemption from liability merely by doing so.

On the other hand, online platforms are not placed under a general obligation to monitor the information they transmit or store, nor to actively investigate the facts or circumstances indicating illegal activity.

It is interesting to note how self-regulation to protect the recipient of services can simultaneously infringe on the rights and freedoms of other (or the same) recipients. Just as X has been accused of doing virtually nothing about moderation, X’s predecessor, Twitter, was not too shy about banning Donald Trump from its platform.

How is enforcement regulated?

Online platforms are also given the means in the DSA to punish service recipients who engage in illegal activity. For instance, illegal content must be removed, but in addition, the customer can also be suspended for a reasonable period of time. At the same time, the processing of complaints from submitters of frequent complaints that turn out to be unfounded can also be suspended.

Enforcement is not only an internal matter arising from the conditions of indemnity. Supervision is assigned to ‘digital services coordinators’ to be appointed by Member States. In the Netherlands, the Authority Consumer and Market (ACM) has been designated for this purpose. The ACM can, for example, issue orders, impose fines, impose orders subject to periodic penalty payments.

Sanctions imposed must be proportionate, effective and dissuasive, rising to 6% of global turnover for fines and 5% of average global turnover per day.

How does ACM know this, apart from its own investigations or through the online platforms themselves?
The DSA introduced a category of third parties called ‘trusted flaggers’. At the request of an entity, ‘trusted flagger’ status is granted by the digital services coordinator of the Member State in which the applicant is based to an applicant who has demonstrated that he meets each of the following conditions:

1. he has specific expertise and competence in detecting, identifying and reporting illegal content;
2. he is independent from any online platform provider;
3. he carries out his activities with the aim of making reports carefully, accurately and objectively.

In addition, the ACM has the power to access data and conduct investigations at the online platform. A new concept is also introduced here, the ‘approved investigator’. On 12 October 2023, the European Commission sent a first request on this basis to X, regarding information on X regarding the Israeli Palestinian conflict.

Follow-up

Following a duly justified application by researchers, the digital services coordinator of the place of establishment grants such researchers ‘approved researcher’ status for the specific research referred to in the application. He shall submit to a provider of very large online platforms or of very large online search engines a reasoned request for access to data under paragraph 4, in which the researchers can demonstrate that they meet all the following conditions:

1. they are affiliated to a research organisation as defined in Article 2(1) of Directive (EU) 2019/790;
2. they are independent from commercial interests;
3. their application mentions the funding of the research;
4. they are able to comply with the specific data security and confidentiality requirements of each request and to protect personal data, and they describe in their application the appropriate technical and organisational measures they have taken to this end;
5. their request demonstrates that access to the data and the time periods requested are necessary and proportionate for the purpose of their research, and that the expected research results will contribute to the purposes referred to in paragraph 4;
6. the planned research activities will be carried out for the purposes set out in paragraph 4;
7. they undertake to publish their research results free of charge within a reasonable time after completion of the research, taking into account the rights and interests of recipients of the service concerned in accordance with Regulation (EU) 2016/679.

Other form of enforcement

Another form of enforcement comes from service recipients. These can hold online platforms liable.

In doing so, the DSA’s liability exemption initially stands in the way. But if the online platform cannot rely on that because it has not complied with the conditions for that exemption, the online platform can be held liable. Such damages should be consistent with the rules and procedures set out in national law and should not prejudice other remedies available under consumer protection rules.

The conclusion should be that at least the patchwork of national rules has been replaced by a harmonised framework. The impact of DSA will certainly be similar to that of the AVG. Any company or individual that either operates or develops an online platform or uses it as a customer will be affected.

In a subsequent article, you will read more about the measures that brokering service providers must take under DSA.

*Warning: For the sake of readability, this article does not strictly adhere to the terminology laid down in the DSA.

Contact

For questions about the DSA, please feel free to contact one of our specialists. You can contact one of our lawyers by mail, telephone or fill in the contact form for a free initial consultation. We will be happy to think along with you.