Compliance Deadline – 17 February 2024
From 17 February 2024, the Digital Services Act (DSA) will come into effect for intermediary service providers.
The DSA aims to create a safer digital space, where fundamental rights of users are protected and a level playing field for businesses is established. Its main goals are to prevent illegal and harmful activities online and to tackle the spread of disinformation. It will do so by providing users of digital services more control over the content they engage with online and by imposing new obligations on those entities that come within the DSA’s scope.
With the 17 February 2024 compliance deadline fast approaching, businesses that come within the DSA’s scope will need to take a number of steps to effect compliance.
Who does the DSA apply to?
The DSA applies to digital intermediaries of all kinds. Building on previous EU regulations, in simple terms, it applies to all intermediary services provided via the internet. However, things are never that simple.
The DSA imposes obligations on businesses, depending on the nature of the intermediary service they provide. These obligations are tiered and cumulative, so that higher categories of intermediary service providers will have more onerous obligations than lower categories. We set out each category below:
1. Caching or Mere Conduit Service Providers
The DSA will impose the least obligations on mere conduit or caching services. Such services include the transmission and/or temporary storage of user provided information in communication networks and will cover businesses such as internet service providers, domain name service providers, and VPNs.
2. Hosting Service Providers
Hosting service providers will be subject to slightly more obligations, including a requirement to inform users when their content has been removed to allow for appeals. A hosting service will be covered by the DSA where it stores information provided by and at the request of the user. The DSA provides examples of such services and include cloud service providers, web hosting services, and file storage and sharing services.
3. Online Search Engine
An online search engine is one of the above caching, conduit or hosting services that also allows users to perform searches of all websites and provides information relating to those searches (e.g., Google Search). Online Search Engines will be required to publish their average monthly users every six months so it can be assessed whether they are a Very Large Online Search Engine.
4. Online Platforms & Online Platforms allowing distance contracts to be concluded
A range of significant new obligations apply to online platforms, including transparency requirements and content moderation. Online platforms are considered by the DSA as hosting services which, at the request of the user, stores and disseminates information to the public. The DSA provides examples of social media networks, and online marketplaces where consumers can conclude at distance contracts with traders. Other platforms likely to be caught include app stores, crowdfunding platforms, and collaborative economy platforms. Online Platforms which allow distance contracts to be concluded are also required to provide information which will allow traders to be traced by consumers, and design their interfaces in such a way that allows traders to comply with existing contract and product safety laws.
5. Very Large Online Platforms (VLOPs) and Very Large Online Search Engines (VLOSEs)
VLOPs and VLOSEs will face the most onerous obligations under the DSA, including establishment of internal compliance functions, mandatory reporting of criminal offences and transparency requirements. This is due to the particular risks these services pose in relation to the dissemination of illegal content and societal harms. To fall within the scope of obligations faced by VLOPs and VLOSEs, the service must have an average of 45 million or more monthly active users in the EU and will then be designated by the European Commission. All platforms and search engines, regardless of size, are required under the DSA to publish average user numbers every six months. Once designated by the Commission, the relevant business has 4 months to comply with the obligations under the DSA. The DSA has applied to VLOPs and VLOSEs since 25 August 2023
There is, however, an important exception to the scope of application of the DSA. If the dissemination of information to the public is merely ancillary to the service provided, the service will not be within scope of the DSA. The DSA provides the example of a comment section on a newspaper website, whereby the comment section is merely ancillary to the service that has been provided that is the sharing of news articles online. It is unclear how this will apply in practice – for example, whether a chat function in a game on the Internet is essential to the service or merely ancillary. We expect this to be a question that will occupy the minds of the Digital Service Coordinators (the name given to the relevant competent authority in each Member State – in Ireland, it is Comisiún na Meán) with guidance to be provided in the future.
The DSA applies to all categories of intermediary services which are offered in the European Union. Importantly, the DSA will apply even if the business itself does not have its place of establishment within the European Union. This is because the DSA focuses on whether the service provider has a ‘substantial connection’ to the European Union, which can be determined through:
• establishment within the European Union;
• a significant number of users of the service being within the European Union; or
• the targeting of services towards a Member State within the European Union.
Time is ticking by fast as the DSA Deadline Day of 17 February 2024 approaches. If you would like any further information or have any queries on how the DSA could impact your business, please contact a member of the Technology team or your usual William Fry contact.
If you would like to assess your business using our free DSA scope analysis tool, please go to this link.
Róisín Culligan, Kevin White.