EU digital services legislation is changing

For the past 20 years, the e-Commerce Directive has been the piece of legislation governing digital services in the EU. Much has changed over these years, and so the EU is introducing Digital Market Act (DMA) and Digital Service Act (DSA), which according to the latest information are expected to be finally adopted during the next months.

When adopted, the DMA and DSA will be binding on various types of online platforms, such as online marketplaces, app stores and social networks, among others. The DMA and DSA are intended to protect the fundamental rights of online service users, to establish a fair and innovative business field for online service providers, to limit the market power of big online platforms and to regulate the digital market to make it safer, fairer and more competitive.

What is the DMA and for whom does it apply?

The DMA is intended to regulate large online platforms, so-called “gatekeepers” such as Amazon, Google, Facebook and others. Criteria stipulate that in order to qualify as a gatekeeper a company needs to provide “core platform services” and to have achieved an annual turnover in the European Economic Area (EEA) of at least EUR 7.5 billion in each of the last three financial years, or have had its average market capitalisation or equivalent fair market value amount to at least EUR 75 billion in the last financial year.

“Core platform services” are (a) online intermediation services, (b) online search engines; (c) online social networking services, (d) video-sharing platform services, (e) number-independent interpersonal communication services, (f) operating systems, (g) cloud computing services.

The DMA aims to ensure fair competition and more choice for users by banning certain practices commonly used by gatekeepers and giving the Commission more power regarding inspections. For example, in order to fight anti-competitive practices from gatekeepers users will be given more choice over the apps they want to install on their phones; while business users will be ensured access to the data that they generate in their use of the gatekeeper’s platform.

The DMA also provides severe fines for violations of established norms: up to 10% of global annual turnover, and for repeated violations the fine can increase up to 20% of global annual turnover. Gatekeepers may also be subject to additional measures for systematic infringements of DMA obligations.

What is the DSA and to whom it applies?

On the other hand, the DSA regulates large online platforms, as well as other online intermediary service providers that act as intermediaries in their role of connecting consumers with goods, services and content. The DSA will establish a set of rules applicable to online intermediary service providers intended to protect users’ fundamental rights; improve transparency, accountability and risk management; and boost innovation, growth and competitiveness. As stated by the President of the European Commission Ursula von der Leyen, the DSA will give practical effect to the principle: what is illegal offline, should be illegal online.

Examples of obligations that the DSA will introduce include:

  • Online intermediary service providers like Amazon, YouTube and others will have to introduce additional measures to counter illegal content online, including illegal goods and services.
  • If certain content is removed, the online intermediary service provider will be obliged to notify the user that uploaded the content on its removal, reasons for removal and introduce mechanisms for the user to challenge the removal.
  • Different requirements on advertising will be also introduced, for example, targeted advertising by profiling children or based on special categories of personal data such as ethnicity, political views or sexual orientation will be banned. In other cases, online platforms will be required to explain to the user why the targeted advertisement is being shown to them specifically.
  • There will be new rules allowing marketplaces to better trace sellers, for example, to protect consumers, online marketplaces will be required to verify the seller’s details to check whether it is a real company.
  • Online platforms will need to provide more detailed information on their terms and conditions.

Unlike the DMA, the DSA will also be binding on smaller companies offering digital services. However, obligations towards the subjects of the DSA will differ depending to their role, size and impact on the online ecosystem. Large online platforms will be affected the most.

Enforcement of rules under the DMA and DSA

Rules under the DMA and DSA will be enforced by the Commission with regard to very large online platforms, and to very large online search engines that will be designated as such by the Commission. Other rules on smaller platforms and rules concerning non-systemic issues on very large online platforms and very large online search engines will be enforced by the national supervisory authorities of EU member states.

Just like the General Data Protection Regulation, the DMA and DSA will have extra-territorial effect, meaning they will apply to companies as long as their users have their place of establishment or residence in the EU.

Adoption of the DMA and DSA is still in progress

The European Parliament and the EU member states reached a provisional agreement on the draft text of the DMA on 25 March 2022 and on the draft text of the DSA on 23 April 2022. It should be added that such an agreement is a political achievement for the EU because of a strong lobby against the adoption of these acts from the Big Tech companies, which will be affected the most.

Both acts are now in the process of technical and linguistic review and formal approval by the European Council and Parliament. Both proposals are expected to be put to a final vote in Parliament in July 2022 before they are formally adopted by the Council. However, the legislative process may also be longer, considering that certain Members of the Parliament objected to the supplements in the text of the DSA when in June 2022 they received it from the Council.

Transition period for invoking obligations on gatekeepers and online intermediary service providers set out under the DMA and DSA

The DMA and DSA will enter into force 20 days after their adoption. However, the obligations set out under the DMA and DSA will become applicable at a later stage.

The DMA obligations will become applicable six months after the DMA enters into force. It is believed that the DMA will enter into force this autumn. If so, it would become applicable in spring 2023.

The DSA obligations will become applicable 15 months after the DSA enters into force or from 1 January 2024, whichever is later. Certain obligations for very large online platforms and very large online search engines will apply from an earlier date, i.e., four months after the DMA enters into force.