On 15 December 2020, the European Commission published its Digital Services Act package which proposes two pieces of legislation: the Digital Services Act and the Digital Markets Act. This package will profoundly change the way companies offer and use digital services in the EU. It affects not just large online “gatekeeper” platforms but impacts the majority of digital service providers and their business users and customers. This blogpost is our first take on the key provisions of both proposals. Keep-up with our Technology & Data blog for detailed analyses of both proposals.
The Digital Services Act will change the rules for handling of illegal or potentially harmful content online, the liability of online providers for third party content, vetting obligations of third party suppliers and the protection of users' fundamental rights online. This makes the Digital Services Act relevant not only for all digital service providers (social media, online marketplaces, online platforms, etc.) in the EU but also for their business users and customers.
The Digital Markets Act regulates the behaviour of core platform services acting as gatekeepers. Gatekeepers are those platforms that serve as an important gateway between business users and their customers and enjoy a significant and durable market position. The Digital Markets Act imposes several prohibitions and obligations on gatekeepers, such as the prohibition to discriminate in favour of own services and obligations to share data that is generated by business users and their customers in their use of the platform. We have produced an alert that looks in more detail at how the DMA will work, and its likely impact. Click here to read the alert.
The Digital Services Act
The Digital Services Act (the DSA) aims to modernise and create an EU-wide uniform framework on the handling of illegal or potentially harmful content online, the liability of online intermediaries for third party content, the protection of users' fundamental rights online and bridging the information asymmetries between the online intermediaries and their users.
The DSA is not intended to replace the e-Commerce Directive but will apply in addition to its national implementations (with the exception of provisions excluding the liability of online intermediaries). The new rules will also be complementary to the e-Platform-to-Business Regulation (EU) 2019/1150 (the P2B Regulation) that became applicable in July 2020 and to the Directives that were adopted as part of the New Deal for Consumers that will enter into force by May 2022.
The main provisions of the DSA include:
- Modernised liability regime for online intermediaries. The key principles from the e-Commerce Directive remain generally unchanged, but the DSA adds obligations to address notifications of content considered as illegal. The DSA requires every hosting provider or online platform to put in place user-friendly notice and takedown mechanisms that allow the notification of illegal content. Online platforms will need to establish internal complaint-handling systems, engage with out-of-court dispute settlement bodies to resolve disputes with their users, give priority to notifications of entities that have been qualified as so-called trusted flaggers by the authorities and suspend repeat infringers.
- New and far-reaching transparency obligations for online platforms relating to the measures taken to combat illegal information. If content is removed, an explanation needs to be provided to the person who uploaded that content. Online platforms must also publish detailed reports on their activities relating to the removal and the disabling of illegal content or content contrary to their terms and conditions.
- Obligation on online intermediaries to include in their terms and conditions information on any restrictions on the use of data provided by the users, with reference to the content moderation mechanisms applied, algorithmic decision-making and human review. This information must be in clear and unambiguous language and publicly available in an easily accessible format.
- Strict requirements for online platforms that allow consumers to conduct distance contracts with traders, to ensure that traders can only offer goods and services via their platforms after strict Know Your Customer procedures. Platforms must keep information about the traders to help track down sellers of illegal goods or services. A platform's interface should facilitate compliance with atraders' obligations to inform consumers and provide appropriate product safety information.
- Transparency obligations concerning online advertisements. For each advertisement and to each user, the online platforms must provide, in real time, clear and unambiguous information to users that (i) they are seeing an advertisement, (ii) on whose behalf the ad is displayed, and (iii) provide meaningful information about the main parameters used to determine why a specific user is targeted by this ad.
- Steep fines for non-compliance of up to 6% of the annual income or turnover of the provider of intermediary services and periodic penalty payments for continuous infringements of up to 5% of the average daily turnover of the intermediary in the preceding financial year per day.
- Online intermediaries without establishment in the EU that provide services in the EU must designate a legal representative in the EU who will be required to cooperate with supervisory authorities, the European Commission and the European Board for Digital Services(a new pan-European group of coordinators that will assist with the harmonisation of the DSA) and can be held liable for non-compliance with the DSA.
In addition to the rules set out above, very large platforms must also comply with the rules set out below. Very large online platforms are those platforms which have more than 45 million active monthly users in the EU, and they will have to:
- Analyse any systemic risk stemming from the use of their platforms and put in place effective content moderation mechanisms to address the identified risks (eg illegal content, privacy violations, etc).
- Provide transparency on the main parameters of the decision-making algorithms used to offer content on their platforms (the rankings mechanism) and the options for the user to modify those parameters. They must provide an option that is not based on profiling. These obligations are clearly inspired by similar obligations in the P2B Regulation and the Omnibus Directive 2019/2161.
- Establish and maintain a public repository, available via application programming interfaces, with detailed information on the online advertisements they served on their platforms in the past year.
- An obligation to designate a dedicated compliance officer responsible for the compliance with obligations under the DSA and undergo an annual independent audit.
- Upon request of the competent authority, very large online platforms must also give access to the data necessary to monitor their compliance with the DSA to the competent authority but also to vetted academic researchers that perform research into the systemic risks.
- In addition, the European Commission will have supervisory and enforcement powers in relation to very large platforms.
The Digital Markets Act
The Digital Markets Act (the DMA) addresses digital market imbalances in the EU, which the European Commission considers to arise from the gatekeeper role of large online platforms (so-called gatekeeper platforms). Please note we have also produced a separate alert on how the DMA works and what its likely impact is.
The DMA aims to set out harmonised rules (ie applying in all EU Member States) defining and prohibiting certain unfair practices by gatekeeper platforms and providing an enforcement mechanism based on market investigations.
The DMA will apply only to providers of 'core platforms services': large, online platforms, such as search engines, social networking services, certain messaging services, operating systems and online intermediation services. The European Commission will designate a provider of core platform services as a gatekeeper if the platform provider meets the following cumulative criteria:
- It has a significant impact on the internal market and is active in multiple EU countries. The DMA indicates that companies with an annual turnover in EEA exceeding EUR 6.5 billion in the last three financial years or having an average market capitalisation of EUR 65 billion or higher, and providing a core platform service in at least three Member States are presumed to meet this criterion.
- It has a strong intermediation position, meaning that it links a large user base to a large number of businesses. A company is presumed to meet this criterion if it operates a core platform service with more than 45 million monthly active end users in the EU and more than 10 000 yearly active business users established in the EU in the last financial year.
- It has (or is about to have) a stable and durable market position. Companies that have met the other two criteria in each of the last three financial years will be presumed to comply with this criterion.
The notion of 'gatekeeper' under the DMA is different from what the DSA names as 'very large online platforms'. For instance, a platform with more than 45 million monthly active end users established or located in the EU will be considered a very large online platform under the DSA, but it will need to meet all three criteria mentioned above to be designated as the gatekeeper under the DMA.
Providers of core platform services meeting these three criteria must notify the European Commission, who will then decide whether that provider must be designated as a gatekeeper. Based on a market investigation, the European Commission can also designate platforms as gatekeepers even if the above-mentioned presumptions do not apply.
Gatekeeper platforms carry additional responsibilities to facilitate an open online environment that is fair for businesses and consumers. The DMA will attribute new powers to the European Commission to enforce non-compliance, including fines, periodic penalty payments and the power to impose additional tailored remedies on the gatekeepers.
The main points of the Digital Markets Act include:
- Gatekeeper platforms will have to comply with a defined set of prohibitions and obligations to avoid certain unfair practices. These include inter alia: prohibitions to discriminate in favour of own services, obligations to ensure interoperability with its platform, and obligations to share data that is provided or generated by business users and their customers in their use of the platform.
- Gatekeeper platforms must allow their business users to promote their offer and conclude contracts with their customers outside the platform. Gatekeeper platforms may no longer prevent consumers from linking up to businesses outside their platforms.
- The European Commission may conduct market investigations into new services and practices, to update the list of core platform services and to identify new practices that are unfair or may limit the contestability of core platform services. To this end, the European Commission will enjoy a broad array of investigative powers, among which the power to request information, to carry out interviews, and to conduct on-site inspections.
- The European Commission may impose fines of up to 10% of the company's worldwide annual turnover and periodic penalty payments of up to 5% of the company's worldwide annual turnover. In case of systematic infringements, the European Commission can impose additional remedies, including behavioural remedies and, when behavioural remedies do not suffice, structural remedies, eg the divestiture of (parts of) a business.
What's next?
The proposals will now be discussed by the European Parliament and the EU Member States via the Council of the European Union. The European Parliament and the Council will first agree on their own versions of the DSA and the DMA. The European Commission, the European Parliament and the Council of the EU will then need to reach an agreement on a final text before the regulations will be adopted. It may take a number of years before the rules are adopted, implemented and become enforceable. Given the importance of the proposed legal change, we advise companies that are likely to be affected by this legislation to follow closely the development of this package of regulations.
We are currently reviewing the legislative proposals and will share our thoughts on specific aspects of both draft acts in future publications. In the meantime, please reach out to us if you would like to discuss the impact new proposals might have on your business.
For additional background, you can read our articles on the consultations by the European Commission that preceded the proposals for the Digital Services Act here and for the Digital Markets Act here.
