Online platforms: ‘notice and takedown’ procedures at heart of updated EU rules

An immediate EU-wide implementation of the DSA should, says Agustinoy, ‘give more strength to a uniform approach to address the issues’ at stake. And this is an area of law that ‘very much calls for harmonisation’, says Kristian Storgaard, a partner at Danish firm Kromann Reumert. ‘In the majority of situations – at least from the perspective of a small country – you would be dealing with a provider that is based or located elsewhere.’

However, Marc Hilber, Projects Officer of the IBA Technology Law Committee and a partner at German law firm Oppenhoff, strikes a note of caution about the possibility of ongoing differences between EU-wide regulation and national laws. ‘The DSA is following a very similar approach to GDPR [the EU General Data Protection Regulation]’, he says. ‘And where GDPR allows the Member States to implement national legislation – for example, in the area of employee data protection – national laws still vary to a great extent.’

In terms of the DSA’s content, the liabilities facing service providers are not dissimilar to those in the e-Commerce Directive, says Hilber. Where the proposed legislation differs is in its detailed focus on transparency. ‘The notice and takedown mechanisms are at the heart of the new regulation,’ he says. Alongside this, companies dependent on websites such as Amazon’s for business will be able to seek greater clarity about decision-making.

Embedded in the proposed rules are oversight procedures – including a requirement for internal complaints management systems – for social media platforms that simply didn’t exist in 2000. The biggest online companies – deemed ‘gatekeepers’ by the DSA – will be expected to self-report and could face more substantial fines than those levied under the GDPR.

Storgaard sees parallels between the DSA’s processes relating to responsibility for online service providers and provisions in the US Digital Millennium Copyright Act 1998. The DSA’s emphasis on notice and takedown processes – where online hosts remove illegal content – goes towards levelling the playing field between EU and US law. It’s ‘much faster and more effective than having to go through court to get a preliminary injunction,’ he says.

Daniel Lundqvist, Chair of the IBA Internet Business Subcommittee and a partner at Advokatfirman Kahn Pedersen, is concerned by Article 31 of the DSA, which would only require platforms to provide advertising data to researchers affiliated with academic institutions. ‘This may actually limit the effect that such transparency obligations can have,’ he says, pointing out that historically, many issues about online platforms have been uncovered by journalists and activist groups.

The DSA’s reliance on the private sector for accountability worried the European Parliament’s Civil Liberties Committee enough that it struck out two key provisions – those requiring service providers to undertake risk assessments and audits carried out by external companies – in its amendments. It argued that compliance assessments by ‘private entities chosen and paid for by providers poses a risk to fundamental rights, as only public authorities are bound by fundamental rights’.

Whether the draft DSA places too much power in the hands of the private sector rather than a public authority or judiciary is ‘a difficult question’, says Agustinoy. He believes the system could be ‘reasonably workable’, as long as large platform operators were ‘also provided with reliable interpretation criteria that would avoid – at least from an ideal perspective – the uncertainties for all involved parties on private enforcement’.

The public authority route can also be costly and time-consuming. For Hilber, the challenge facing a regulation such as the DSA is achieving a ‘difficult balancing act’ between ensuring companies abide by the rules and encouraging private enterprise. He says this shouldn’t involve ‘any authorities specifically coming in and telling companies what they should do on their platform.’

Lundqvist believes that people shouldn’t ‘expect too much change due to mandatory risk assessments and audits’ – even if the DSA’s existing provisions remain. He argues that any ‘serious online platform’ will already perform risk assessments. Even with regulation, he says, ‘one can expect that any risk assessment will not drastically alter the implementation of some aspect of the online platform for which there is a business case’.

Another key feature of the DSA is its ‘three-tier’ system of different levels of regulation for service providers depending on if they are small enterprises, ‘regular’ online platforms or the so-called ‘very large online platforms’ that most commentators agree are the ultimate target of the DSA. ‘The burden of additional requirements,’ says Lundqvist, ‘is hopefully proportional to the societal impact of those platforms as they grow.’

Image: metamorworks C / Shutterstock.com