Digital Services Act approved and to become EU law

The vote approving the DSA by the Council of Ministers on Tuesday follows the earlier approval of the legislation by MEPs. The new laws (312-page / 686KB PDF) set out extensive requirements for online intermediaries over the way they moderate content posted, and police the goods and services traded, on their platforms.

The DSA will only come into force 20 days after its publication in the Official Journal of the EU. No date has yet been set for publication. A date of 19 October has, however, been set for the president of the European Parliament and the president of the Council to sign the DSA. Publication in the OJEU would follow on a subsequent date.

Out-Law anticipates that the DSA will come into force sometime in mid-November. The precise date will be of particular interest to online platforms because, while most of the provisions of the DSA will not take effect until the DSA has been in force for 15 months, some of the new rules will have effect immediately – including reporting obligations that will have a bearing on whether those platforms are considered ‘very large online platforms’ and therefore subject to the most stringent requirements of the DSA or not. There is a three-month deadline set for compliance with the disclosure duties.

The DSA builds on existing provisions of EU law under the E-Commerce Directive, which governs what online intermediaries need to do currently when they become aware of the existence of illegal activity on their services.

The DSA will introduce a new ‘notice and action’ procedure for reporting, and for the potential removal or blocking of access to, content.

Other new measures agreed include provisions aimed at curbing targeted advertising based on the use of individuals’ sensitive personal data. Targeted advertising at children using any of their personal data will be prohibited. The new legislation agreed will also place restrictions on the way platforms can influence user behaviour through the way their interfaces are designed or operate.

The most stringent rules will apply to businesses that fall into the category of very large online platform, or very large online search engine. Those businesses are obliged to carry out an annual assessment to identify systemic risks associated with their services with a view to them addressing those risks. The dissemination of illegal content is one specific risk that is listed in the DSA that the businesses will be required to assess against. Other risks listed include actual or foreseeable negative effects on civic discourse and electoral processes, and public security.

Frankfurt-based technology law expert Nils Rauer of Pinsent Masons said: “The regulatory changes the DSA brings about follow a staggered approach depending on the category a service provider falls into – even medium-size platforms and interfaces will face unprecedented requirements on the processes they must put in place and the information they will need to report. To understand the full scope of their liabilities, online businesses will need to determine in which category they belong. Notably medium-sized intermediary providers will need guidance on this in order to take the right measures.”

Amsterdam-based Wouter Seinen also of Pinsent Masons said: “The DSA is not simply about making some changes online terms and conditions. It requires more fundamental structural amendments to the service infrastructure. Notably, the ways in which information is offered to safeguard adequate transparency will require an overhaul. Equally, redress mechanisms need to be developed and/or refined.”

“Economically, we will see a great push for the development of automated tools allowing for smart content review. Those tools will use AI, but also will require a fine dovetailing with human review being built in where necessary,” he said.

The European Commission will gain new powers of supervision over the activities of very large online platforms and very large online search engines under a new regulatory framework that will involve national regulators taking responsibility for overseeing the compliance of smaller businesses that are subject to the DSA.

The DSA also provides for a new “crisis mechanism” that will enable the European Commission to intervene at times of threats to public security or health: for example, to issue directions to very large platforms to take actions to minimise inherent risks.

Fines of up to 6% of annual global turnover of will be able to be levied on online platforms and search engines that fail to comply with the new legislation.

Luxembourg-based Aurélie Caillard of Pinsent Masons has highlighted how the DSA could also influence the way online intermediaries manage disinformation risk.