The DSA is now a reality for VLOPs

The DSA is one of the laws in the context of the EC's digital strategy. This digital strategy aims to make digital transformation work for people and businesses, while contributing to the EC's goal of a climate-neutral Europe by 2050. Other laws include, among others, the Digital Markets Act, the Data Governance Act, the Data Act and the Artificial Intelligence Act.

Online intermediary services, such as online marketplaces, app stores, sharing economy platforms, search engines and social media platforms, must meet a series of obligations from 17 February 17 2024 to ensure transparency, accountability and compliance. VLOPs and VLOSEs must comply with all (more stringent) obligations from today, 25 August 2023. This includes online platforms with an average of more than 45 million monthly active users in the EU. This applies to all known social media channels and to commercial websites such as Booking.com, Zalando, AliExpress and Amazon. The EC will adopt guidelines in the coming year to further define the application of the DSA.

Recent developments

• By 17 February 2023 and at least every six months thereafter, providers of online platforms and search engines need to publish information on the average monthly active recipients of their service in the EU. The EC has published guidance (in the form of a Q&A document) on the methodology for calculating these numbers of average monthly active recipients of the services. The numbers must also be reported upon request of the relevant Digital Service Coordinator and the EC.
• Based on article 43 of the DSA, the EC shall charge VLOPs and VLOSEs with an annual supervisory fee. The estimated fee will be based on costs that the EC incurs in relation to its supervisory tasks under the DSA. On 2 March 2023, the EC published the delegated act on the methodologies and procedures regarding this annual supervisory fee. 
• On 25 April 2023 the EC designated seventeen VLOPs and two VLOSEs (Bing, Google) that reach at least 45 million monthly users in the EU.
• On June 27 2023 and July 11 2023, Zalando and Amazon filed a legal claim at the Court of Justice of the European Union. Zalando and Amazon contest the designation as a VLOP by the EC under article 33 of the DSA. In short, Zalando argues that the EC did not take into account the majority retail nature of its business model and that it does not present a "systemic risk" of disseminating harmful or illegal content from third parties. In addition, Zalando states that no clear and consistent methodology is used to assess whether a company is designated as a VLOP and that platforms are treated unequally as a result. Amazon argues that the company does not fit the description of VLOP under the DSA. In addition, Amazon believes that if Amazon is designated as a VLOP, other competitors in the EU should also have been designated as VLOPs.
• By 25 August 2023, these designated VLOPs and VLOSEs need to comply with the full set of obligations under the DSA, including conducting risk assessments, implementing content moderation tools, and ensuring user empowerment, protection of minors, diligent content moderation, transparency, and accountability. Furthermore, this means that these VLOPs and VLOSEs need to adapt their systems, resources, and processes for compliance, set up an independent system of compliance and carry out, and report to the EC, their first annual risk assessment.

Upcoming milestones

• By 17 February 2024, all other intermediary services must comply with the applicable obligations under the DSA.
• By 17 February 2024, the EU Member States must designate their Digital Services Coordinators (DSC). The DSC shall be responsible for all matters relating to supervision and enforcement of the DSA in its Member State. The DSC shall cooperate with each other, other national competent authorities, the Board for Digital Services and the EC. In the Netherlands the Authority for Consumers and Markets (ACM) will most likely be designated as DSC. It is expected that the Dutch DPA (Autoriteit Persoonsgevens) will play an important role as well.
• Also, the European Board for Digital Services (Board) will be established. The Board shall be composed of the DSC who shall be represented by high-level officials and shall be chaired by the EC. The Board will assist with consistent enforcement of the DSA within the EU (e.g. joint investigations, support in the analysis of reports and results of audits, and issue opinions, recommendations or advice). VLOPs and VLOSEs will be regulated by the EC. 
• It is expected that the EC will adopt the final text of the delegated act on conducting independent audits by the end of 2023. The draft act provides the main principles that auditors should apply when selecting auditing methodologies and procedures and provides further specifications for auditing VLOPs and VLOSEs compliance with risk management and crisis response obligations. It includes templates for the audit report and audit implementation reports that will be made public and submitted to the EC and the DSC in the country of establishment of the VLOP or VLOSE. The first audit reports are due at the latest one year after 25 August 2023. Coordinated by PwC’s international office in Brussels, PwC provided feedback on the delegated act.
• From 2025, the EC shall evaluate and report to the European Parliament, the Council and the European Economic and Social Committee on the DSA.

Implementing/delegated acts expected to be adopted by the EC

• Article 24 DSA, implementing act to lay down templates concerning the form and content of transparency reports requested from providers of online platforms.
• Article 41 DSA, technical conditions under which VLOPs and VLOSEs are to share data with relevant authorities and vetted researchers.
• Article 85 DSA, implementing acts laying down practical and operational arrangements for the functioning of information sharing systems between the DSC, the Board, and the EC.

We will continue to provide updates on key milestones in the coming months. We will shortly be hosting a client roundtable on the latest developments in the DSA, synergies with other regulations, audit requirements and case studies. More information will follow.

In the meantime, please be aware of the following points of attention: 

Points of attention for VLOPs and VLOSEs

• By 25 August 2023, the designated VLOPs and VLOSEs need to comply with the full set of obligations under the DSA.
• VLOPs and VLOSEs need to start preparing for the first audit requirement which will be due on 25 August 2024. It is expected that the audit guidelines will be finalized by the EC before the end of the year. 

Point of attention for all other intermediary services falling under the scope of the DSA

• All other intermediary services falling under the scope of the DSA must comply with the applicable obligations under the DSA by 17 February 2024. It is important to start implementing in time since the obligations under the DSA will affect systems, resources, and processes.
• Companies incorporated outside the EU offering services in the EU will also be affected by the DSA.