Slightly later than anticipated, the European Commission published its long-awaited legislative package, comprising the Digital Services Act (DSA) and Digital Markets Act (DMA) on 15 December. For our summary of the DMA, please click here.
The DSA builds on the key principles of the e-Commerce Directive dating back to the year 2000 and modernises the EU’s legal framework for a variety of digital services providers, including those that act as online intermediaries. The Commission observed that although online intermediaries have created significant benefits for consumers and innovation, they can also be used as vehicles for disseminating illegal content, goods and services, and some large intermediaries have become “quasi-public spaces for information sharing and online trade”.
Scope
Binding EU-wide obligations will apply to most intermediary service providers, ranging from network infrastructure providers (including ISPs), hosting service providers (including providers of cloud services), online platforms that bring together sellers and consumers (including marketplaces and app stores) and “very large” online platforms (including some social networks). The obligations are intended to be graded depending on the size, impact and systemic characteristics of the relevant service provider.
Although some obligations will apply to most intermediary service providers, additional obligations will apply to providers of hosting services, and in particular to online platforms (classified as a subset of hosting services). A further subset of rules focus on very large online platforms, defined as those platforms that reach more than 45 million users in the EU, calculated as an average number of monthly active service recipients (roughly 10% of the EU's population).
The DSA will apply to relevant intermediaries operating in the EU, including those established in a third country that offer services within the EU. Underlying the intended extra-territorial reach of the DSA is an obligation on non-EU providers to appoint a legal representative in the EU.
What are the obligations?
The obligations are far reaching but asymmetric, depending on the characteristics, size and social impact of the relevant provider.
Illegal content: online platforms providing hosting services (i.e. not only very large platforms) are obliged to implement user-friendly notice and action mechanisms to enable users to draw unlawful content to their attention. Relatedly, online platforms must cooperate with “trusted flaggers” and take action in respect of notices in a timely manner. User notifications that meet specified criteria will constitute actual knowledge for the purposes of what has traditionally been referred to as the ‘hosting defence’ referred to in Article 5 of the DSA. Whilst the DSA largely preserves the e-Commerce Directive’s liability exemptions, it provides helpful clarifications and expressly confirms that despite not introducing active monitoring obligations, providers who take proactive steps to detect, identify, remove or disable illegal content will not be deemed ineligible for the liability exemptions in Articles 3, 4 or 5.
Transparency: online platforms are also expected to provide far more information to users in relation to advertisements (and distinguish advertisements from other online content), including how advertisements are targeted and the identity of the legal person(s) on whose behalf the advertisement is displayed. The intention is to distinguish organic content from sponsored content. Very large platforms will be expected to go further and maintain and disclose their advertising repositories to relevant authorities.
Traceability: some online platforms will also be subject to new rules relating to the traceability of business users in online market places - to help track down sellers of illegal goods or services. These online platforms will also be obliged to undertake due diligence on their business users who conclude distance contracts with consumers through their platforms.
Other rules related to out-of-court dispute resolution processes, content moderation, external risk auditing, public accountability and data sharing obligations have been introduced, again depending on the nature of the intermediary service provider in question.
Penalties
Each Member State will be required to appoint a Digital Services Coordinator, an independent authority responsible for supervising the intermediary services established in their Member State and for coordinating with specialist authorities. The Commission will have direct supervision powers over very large platforms.
Failure to comply with the DSA’s rules may, in the most serious cases, result in fines of up to 6% of the annual turnover of the service provider or platform in question. The provision of incorrect, incomplete or misleading information or a failure to submit to inspection may result in a fine not exceeding 1% of annual turnover.
The Commission also points out that the DSA will not replace sector-specific legislation and does not define illegal content. The DSA will not impose measures regarding the removal of harmful (c.f. unlawful) content, although it will oblige very large platforms to assess and mitigate the systemic risks their systems pose – including the “intentional manipulation” of their services (including where that manipulation may have a negative effect on public health, electoral processes or public security).
Although raised in the context of the public consultation, the DSA does not contain any provisions relating to platform workers.
What’s next?
Given the degree of interest shown in the DSA before the publication of the legislative proposal from the Commission, as well as recent battles around related legislation such as the Copyright Directive, the legislative process is likely to be protracted. We expect that the inter-institutional negotiations to finalise the text will take between 18 and 24 months, and the Regulation could theoretically apply as of early/mid 2023.
We expect considerable debate in the European Parliament as to which committee takes the lead on the DSA. In the Council, we can expect the Portuguese Presidency, kicking off on 1 January 2021, to make this a clear priority.
