European Parliament formally adopts Digital Services Act

Following provision political agreement by the Council and the European Parliament in April 2022, on 5 July 2022 the European Parliament formally adopted the Digital Services Act (DSA). The DSA has yet to be adopted by the Council.

Background

The EU's DSA is, along with the Digital Markets Act (DMA), part of a package of European legislation proposed in late 2020 to regulate digital markets. The main aim of the DSA is to implement a new framework of obligations applying to all digital services (e.g. those offered by internet service providers, cloud services, messaging, marketplaces, social networks, content-sharing platforms, app stores and online marketplaces) to keep users safe from illegal goods, content or services, and to protect their fundamental rights online. The DMA targets certain behaviours of platforms acting as 'digital gatekeepers' to the single market.

While the DSA is European legislation it applies to all providers of intermediary services irrespective of their place of establishment or location, in so far as they offer services to (or target their activity towards) a significant number of recipients in the EU. The DSA therefore has relevance to UK based providers that offer services in the EU.

In a previous post we discussed how the European Parliament’s proposed amendments to the DSA in January 2022 might affect consumers. These amendments have now been incorporated into the text of the DSA adopted by the European Parliament. Below we highlight some of the other key changes to the DSA since the European Commission's original proposal:

• Voluntary own-initiative investigations—under the DSA, to be eligible for the conduit, caching and hosting exemptions from liability, providers of intermediary services must carry out voluntary own-initiative investigations or other activities aimed at detecting, identifying and removing, or disabling access to, illegal content or take action to comply with their national laws, including the DSA. The final text of the DSA adds a condition that these own-initiative investigations and other activities must be carried out 'in good faith and in a diligent manner'. According to the recitals to the DSA, acting in 'good faith and in a diligent manner' includes providing necessary safeguards against unjustified removal of legal content – e.g. by taking reasonable measures to ensure that where automated tools are used to conduct such activities, the technology is sufficiently reliable to limit the rate of errors to the 'maximum extent possible'. 

• Hosting—under the DSA, to benefit from the hosting exemption, an online platform must make it clear to consumers that they are dealing with a third party, rather than the platform itself. An addition to the text of the DSA means that a platform could now lose the benefit of the hosting exemption if it: (1) fails to clearly display the trader's identity as required under the DSA; (2) withholds the trader's identity or contact details until after contract conclusion; or (3) markets the product in its own name (rather than the name of the third party trader supplying it).
  
  
• User friendly and electronic single point of contact—the final text of the DSA includes a new requirement for providers of intermediary services to designate a single point of contact enabling the recipient of the service to communicate directly and rapidly with them, by electronic means and in a user-friendly manner. Recipients of the service should be able to choose the means of communication, which must not solely rely on automated tools.
  
  
• Terms and conditions—the DSA sets out specific requirements relating to the content and accessibility of terms and conditions (T&Cs). The final text of the DSA includes additional requirements for providers to: (1) tell service recipients about their internal complaint handling systems and any significant changes to their T&Cs; and (2) where services are used by minors, to explain their T&Cs in a way that minors can understand. Providers designated as 'very large online platforms' or 'very large search engines' must also provide T&Cs in a machine-readable format and in the official languages of all Member States in which they offer their services.
  
  
• Advertising on online platforms—the final text of the DSA broadens the transparency obligations for online platforms that present advertising on their online interfaces. Such platforms are now required to use prominent markings to identify adverts and provide users with information on how any parameters used to select them as an audience for the advert can be changed. Advertising based on profiling using special categories of sensitive personal data is also now expressly prohibited.
  
  
• Right to information—a new provision in the DSA now requires online platforms to notify consumers if they become aware that the platform has been used to sell an illegal product or service to consumers.

Next steps

Once formally adopted by the Council (expected in September 2022), the DSA will be published in the EU Official Journal and will enter into force twenty days after publication. The DSA will become directly applicable across the EU fifteen months thereafter, or from 1 January 2024 (whichever is later). Platforms designated as 'very large online platforms' or 'very large online search engines', may be impacted sooner – for these platforms, the DSA will apply four months after they have been designated as such by the European Commission.

Practical tips

With the DSA due to take effect in early 2024, businesses that haven't already started preparing for this should do so now. This is particularly important as complying with the DSA may require significant changes to current business practices that will require time to plan and roll out.   Depending on the specific scope of changes required, businesses may need to take on additional resource to implement any required changes and seek legal advice to ensure compliance with the requirements of the DSA – e.g. requirements relating to their T&Cs, information gathering and reporting, display/provision of information under transparency obligations, and notice and action/take down processes. 

Businesses that do not comply with the requirements of the DSA risk enforcement action by new Digital Services Coordinators which will have enforcement powers in each Member State including the power to impose penalties, such as fines. Very large online platforms and very large online search engines that infringe the DSA may also be fined by the European Commission up to 6 % of their total worldwide annual turnover.