Thorough revision of the rules for online platforms

Safer digital space

The DSA, together with the Digital Market Act (DMA), is part of the Digital Services package of the European Commission (EC). This package seeks to create a safer digital space in which the fundamental rights of users are protected and competitive conditions for businesses are the same. The DMA introduces a new regulatory mechanism to ensure fair competition in the markets in which large online platforms and their customers operate. Topical issues in addition to the Digital Services package include the protection of labour relations and regulations to increase fiscal transparency in the digital economy (DAC-7). 

The DSA relates to the day-to-day processes of the provision of intermediary services, including online platforms. The new act provides a better mechanism for removing illegal content and protects the fundamental rights of consumers in the online world. The DSA also provides a clear framework for transparency, promotes innovation, growth and competition, and ensures stricter government supervision of the larger platforms.

Scope of the DSA

The DSA does not cover the online platform industry as a whole, but focuses on the providers of intermediary services, i.e. the part of the industry that engages in the transmission, storage and public dissemination of content generated by users.

The users or recipients of the services - both natural and legal persons - must have a place of residence or an establishment in the European Union (EU). This means that the DSA also applies to organisations that are not established in the EU, but do have users in the EU or activities aimed at the EU. In general, providers of social media platforms, messaging services, review websites, internet service providers (ISPs) or digital 'open' marketplaces will fall under the DSA, but providers of mere film and video streaming services will not. Also platforms where individuals can post videos or sell products themselves will fall within the scope the DSA.

Category 1: intermediary services

According to the DSA, intermediary services are service providers that offer a ‘mere conduit’ service. Think of parties offering caching services or providing networks over which content can be transmitted, such as ISPs.

Category 2: hosting services

The second category concerns hosting services that also store the information provided by the user ('hosting service providers’). These are organisations that provide the IT infrastructure for, among other things, websites, cloud services and e-mail.

Category 3: online platforms

The third and fourth categories concern online platforms, which store and disseminate the user's information publicly on request. Think of social media platforms, music and video services where individuals can post content themselves, online marketplaces, search engines, platforms that link customers to drivers for transport or to homeowners for accommodation or to restaurants for meal delivery.

Category 4: very large online platforms

Very large online platforms (>45 million users in Europe), have additional obligations, including crisis response and external audits. The number of users determines whether a platform belongs to category 3 or 4. In addition to all applicable rights and obligations under the DSA, also the rights and obligations under the DMA can apply to this category of platforms. This is the case if they offer core platform services AND have been designated as 'very large online platforms'.

It is important that you assess in which category or categories your organisation falls,  because this also determines the rights and obligations applicable to your organisation.

Obligations for all categories of organisations

The first set of obligations in the DSA applies to all categories of organisations in the pyramid. Because of the broad scope of category 1, the biggest changes are in the areas of liability, illegal content, adjusting general conditions, transparency and permanent contact points.

Online service providers that take action on their own initiative to block illegal content can still, to a certain extent, rely on limitation of their liability. Previously, providers of 'mere conduit', 'caching' or ‘hosting’ services were sometimes reluctant to take such action on their own initiative, because they wanted to avoid becoming liable if their checks for illegal content would fail. Because the DSA now stipulates that these service providers can still rely on limitation of their liability in such cases, this type of action is no longer discouraged.

In addition, organisations must comply with orders from the authorities regarding (the removal of) illegal content. Banning illegal content is subject to transparency obligations and the assessment process must be public. This way, online providers cannot remove content randomly. In the general conditions ('terms of use'), providers must state all restrictions that can be imposed on the recipients of the service. They must for example specify what the provider regards as illegal content and may therefore remove. The terms of use may also provide for procedures or measures with regard to this 'content moderation'.

There is also a duty of care, requiring providers to make an annual transparency report. Providers must state in this report to what extent they have engaged in ‘content moderation’ and how they have acted on orders from the authorities regarding illegal content. The transparency report contains additional obligations for (very large) online platforms, which we will explain below.

Finally, all online providers must designate a central contact point for direct communication with national authorities, the European Commission and the European Digital Services Council. Providers must make this contact information publicly available to facilitate communication and, indirectly, the implementation of the DSA. If a service provider is not established in the EU, but does offer services in it, it must designate a legal representative instead of a contact point.

Obligations for hosting services and (very large) online platforms

Hosting services - the second category in the pyramid - and consequently also (very large) online platforms, have the obligation to set up a 'notice and action' mechanism. This means that they must remove illegal content - for example, copyrighted material or information that defames individuals - immediately upon notification by third parties. Or that they must contact the notifier to obtain more information about the posted content. The above does of course only apply if the notification is sufficiently substantiated. Your organisation will have to develop procedures to make it easy for third parties to make notifications. You will also have to train your staff to handle, assess and check such notifications and  explain your response to them to the notifier.

Points of attention for online platforms and services

Although the legislative text is not yet final, the rights and obligations are already clear in outline. On 5 July, Tthe European Parliament adopted the DSA as agreed upon in collaboration with the European Council.

The European Parliament and the European Council will still have to approve the final legislative text - which has been before the European Parliament and the EU Member States since May 2022. This is expected in September 2022.

Next, there will be an implementation period. Enforcement will start in the first quarter of 2024 at the earliest. This is different for very large online platforms, in respect of which enforcement will start at an earlier stage, i.e. four months after they have been classified as a 'very large online platform' by the authorities.

Given the large and ever-increasing role that online platforms and services play in our economy, the scope and application of the DSA will be extensive. To prepare for its entry into force, you can take the following steps:

• Check whether your organisation falls under the DSA and if so, in which category or categories;
• Then check whether you comply with the cumulative rights and obligations applicable to the category or categories you are in;
• Check to what extent your business practices are in line with these rights and obligations;
• To the extent your business practices are not in line, adapt them as quickly as possible. Think of:

1. Adjusting your general conditions or terms of use
2. Creating a legal representative or a central contact point
3. Setting up a ‘notice and action’ mechanism 
4. Setting up a complaints handling system; 
5. Setting up a 'know your customer' procedure