The Digital Services Act (DSA) will impose obligations on ‘intermediary services’ which focus on content moderation, transparency and accountability. These obligations apply in a cascading fashion, with a base level of universal obligations and more onerous obligations applying to three specific categories of service provider. The DSA will apply where recipients of a service are based in the EU, regardless of the service provider’s place of establishment. It provides for significant fines of up to 6% of global turnover for non-compliance.

Who is covered?

The DSA applies to ‘intermediary service’, the definition for which includes a wide range of online services. In terms of the obligations which apply, the DSA distinguishes between the following types of intermediary service:

• ‘Caching’ and ‘mere conduit’ services, such as internet access providers.
• ‘Hosting services’ being services consisting of the storage of information provided by, and at the request of, a recipient of the service.
• ‘Online platforms’, being a subset of hosting services that also disseminate information to the public, such as social media and online marketplaces.
• Very large online platforms and search engines (VLOPs and VLOSEs), being online platforms which have an average monthly user base in the EU of at least 45 million.

Significant obligations

The DSA contains a wide array of obligations. The obligations applying to different online services match their role, size and impact in the online ecosystem. Examples some of the more significant obligations include that:

• All services will be required to respond to orders to act against illegal content on their services and inform users of their actions. Terms and conditions will also need to be updated to reflect content moderation practices.
• All hosting services must also put in place ‘notice and action’ mechanisms to enable anyone to flag illegal content and to ensure that they act upon same in a timely manner.
• All online platforms must also have an effective internal complaints handling system and must put in place "appropriate and proportionate measures" to ensure a high level of privacy, safety, and security of minors. We expect European Commission guidance to assist service providers with this, and other, unclear obligations.
• Online marketplaces must also carry out ‘Know Your Business Customer’ checks. Marketplaces which allow consumers, i.e. natural persons, to conclude contracts with traders must verify basic identity information about the traders conducting business on their platform, and must enable traders to comply with pre-contractual requirements on-platform easily. They must take steps to inform consumers if illegal products or services were sold on the marketplace.
• In addition to all of the above obligations, VLOPS and VLOSEs have auditing and accountability obligations and must carry out wide ranging periodic risk assessments on, for example, the dissemination of illegal content on their platforms, any actual or foreseeable negative consequences their services might have for minors, civil discourse, gender violence and civic discourse.

Ireland’s role

Ireland will have pan-EU regulatory responsibility for service providers having their main EU establishment there, except for VLOPs and VLOSEs in relation to which the European Commission will take primary responsibility. National regulators known as Digital Services Coordinators (DSCs) have general responsibility for ensuring implementation and enforcement of the DSA. A new Media Commission, to be established under the Online Safety and Media Regulation Bill, is to be Ireland’s DSC under the DSA.

Timelines and next steps

The DSA will enter into force on 16 November 2022 and will apply to most services from 17 February 2024. However, the DSA will apply to VLOPs and VLOSEs sooner than this. Although online platforms have until 17 February 2023 to publish information on their average monthly active users, from 16 November 2022 the European Commission will have the power to request this information and adopt decisions designating online platforms as a VLOP or VLOSE. The DSA is to apply to such services four months from designation.

Next steps for service providers:

• Are your services within scope? Providers should consider their services on offer. Services may be entwined requiring providers to establish a process to decide where to draw the line, particularly for calculating monthly active users, complying with different sets of obligations or where an online marketplace might be integrated into a product.
• Internally, consider whether and to what extent you need to change systems and practices in order to facilitate compliance with the various requirements under DSA. This will of course depend on the nature of the service and scope of obligations which apply.
• Externally, consider whether and to what extent you need to adjust your user interface and terms and conditions to comply with the DSA.
• If you operate an online marketplace, consider whether you have processes for gathering and verifying identity information on traders. Does your marketplace provide the transparency for consumers, and allow you to suspend traders and products for non-compliance?

Ensuring compliance with the DSA will involve careful consideration of the various obligations. We recommend that all relevant businesses / organisations take steps now to familiarise themselves with the scope of the Act. For more information on the likely impact of the new legislation, contact a member of our Technology team.

The content of this article is provided for information purposes only and does not constitute legal or other advice.