EU gets one step closer to adopting the Digital Services Act

Negotiations between relevant stakeholders regarding the EU’s Regulation on a Single Market for Digital Services - better known as the Digital Services Act (DSA) - have come to an end. After numerous and extensive discussions, the French presidency of the Council of the EU, the Commission and members of the European Parliament have reached an agreement.

The DSA will fundamentally change the liability regime for online services in the EU. It not only provides for strict obligations for supervision of illegal content online but also introduces new rules on transparency, user safety and advertising accountability for digital services.

While the final draft is not yet available, it is important for businesses to understand the ambition of the legislative changes which build on the existing e-Commerce Directive (Directive 2000/31/EC), adopted in 2000 – more than 20 years ago. Preparation and compliance are crucial as the Digital Services Act allows for significant fines and remedies (potentially fines up to 6% of worldwide turnover). We expect intensive scrutiny by regulators and authorities across the EU.    

What is the DSA?

A lot has happened in the digital environment in the 20 years since the adoption of the e-Commerce Directive and the DSA aims to address these changes. The goal of the new legislation is to make the online world in its many facets a safer and more trustworthy environment. The key principle of the DSA is the proposition that what is illegal offline should also be illegal online. The DSA sets out a legal framework which should offer a reliable and harmonised set of “rules for the internet”.

National regulators advised by an independent group of Digital Services Coordinators and the newly introduced European Board for Digital Services, will be dedicated to enforcing this legislation. The new agreement provides for enhanced supervision conducted by the European Commission for very large online platforms.

Who is in scope?

The DSA broadly applies to all online intermediaries that offer digital services or products in the EU, irrespective of their place of establishment.

It sets out a layered approach to address the liability and accountability of all players involved in digital business, depending on their size and role. It addresses online platforms and services, including online marketplaces which will be subject to due diligence obligations in respect of the merchants that offer their products and services.

The strictest regulatory regime applies to very large online platforms and very large online search engines, being those with more than 45 million monthly active users. These will have to implement strict processes towards regular risk assessments, produce reports of action regarding content moderation and will be obliged to conduct external annual audits. They will have to disclose their parameters for recommender systems and provide for at least one recommender system which does not involve profiling. In addition, the Commission as well as the Member States could have access to their algorithms.

What does the DSA stipulate in detail?

More proactivity in the fight against illicit content: The DSA preserves the "safe harbour" principle, under which online intermediaries that host or transmit content from third parties are exempt from liability unless they are aware of the illegality of a content item and are not acting expeditiously to remove or to disable access to it. However, the notice and take down action obligations currently imposed are to be strengthened. Businesses will be required to remove illegal content such as hate speech, terror propaganda, discrimination and also counterfeit goods immediately. Users will be able to easily report such content through a notice and action mechanism and, subsequently, they should also be able to challenge the respective removal decisions. A complaint handling system will have to be implemented by the businesses, while ensuring notices are processed in a non-arbitrary and non-discriminatory manner and with respect for fundamental rights. Additionally, alternative dispute resolution will become mandatory. So-called trusted flaggers who can report illegal content (and whose reports must be handled with priority) will be able to help the supervisory bodies to ensure compliance with the new rules.

As illegal content will be defined by EU laws as well as national laws (according to the definition which the latest draft of the DSA proposed), it will be crucial to monitor legal developments in all Member States which will potentially be a big challenge for companies

Prohibition of dark patterns: The prohibition of so-called dark patterns introduced by the DSA has already been the subject of much debate, and has been similarly controversial in this last round of discussions between the stakeholders. The agreement of the DSA will now provide for a ban of misleading interfaces using deceiving or nudging techniques to influence user behaviour. Websites will have to be designed in a user-friendly and age-appropriate way to make sure users can make informed decisions. The prohibition has been softened to the extent that practices already covered by consumer protection or data protection law will continue to be evaluated under these existing laws.

Protection of minors: Minors’ privacy will further be protected by the new regulations which prohibit online services from using personalised advertising towards them.

More responsibility for online marketplaces: Online marketplaces will need to present clear, easily accessible, and broad information regarding their merchants to the users. The traceability of traders will also include a due diligence process prior to giving them access to a platform, including random checks, in order to assess if the information they provide is reliable.

Online advertising: Specific transparency obligations also apply with regard to online advertising targeting the users of such services. Users’ knowledge about whether a displayed item is an ad, from whom the ad originates and the parameters used to decide to whom it will be displayed will be essential in this context.

Special crisis mechanism: In light of the present global situation the new agreement on the DSA additionally introduces a special crisis mechanism which aims to limit the possibility of manipulation through the internet if a crisis such as war, terror or a pandemic happens. In this context, the European Commission will be able to require very large online platforms to take specific action concerning urgent threats on the platform. Overall, the DSA will bring a lot of new obligations including transparency, reporting and due diligence obligations and will affect all kinds of online services in multiple ways. The new regime affects the user interface, internal processes and the legal notices and documents which will need to be updated.

Implications for national laws in Germany and France?

Germany

Several years ago, the German legislator introduced the Network Enforcement Act (Netzdurchsetzungsgesetz, or NetzDG) which, just like the DSA now, addresses the combat of crime and hate speech on the internet. Therefore, it is almost certain that the NetzDG will cease to exist as it is supplemented by the DSA. The German legislator has announced that a national Digital Services Act (Digitale Dienste Gesetz) will be drafted, which is meant to align the current law accordingly.

France

Although criticised by the European Commission, the French legislator introduced in August 2021 a regime very close to that provided for in the draft DSA which imposes the same type of due diligence obligations on intermediaries’ services, in order to fight against the spread of hateful content. This law will disappear when the DSA comes into force.

Expected timings

In the very near future, we expect the text to be finalised and officially formally approved. The new rules will then apply fifteen months after its adoption, after which the DSA will be directly applicable in all Member States. This is currently expected to happen in late 2023. However, very large online platforms could be affected even before this date, as the press release of the European Commission states that for them the DSA will apply four months after their designation.