The Digital Services Act: why you should review your hosting services

The Digital Services Act will modernise the e-Commerce Directive regarding illegal content, transparent advertising, and disinformation. This is a good opportunity for your business to review your hosting services.

On 4 October 2022, the Council of the European Union formally adopted the Digital Services Act (DSA). The intended impact of the legislation is to effectively protect the fundamental rights and freedoms of users – including the right to free speech.

Key provisions

The Digital Services Act (DSA) includes:

  • Measures to speed up and improve the removal of illegal goods, services and content online, including by requiring cooperation with so-called ‘trusted flaggers’ – organisations that monitor for such content and goods and can be trusted to make accurate reports
  • Rules on traceability of business users in online marketplaces to crack down on scams and sellers of illegal products
  • The introduction of effective safeguards for users, including mechanisms whereby users of platforms can effectively challenge decisions by those platforms
  • Bans on certain types of online adverts – specifically those targeting vulnerable groups or using special category (ie sensitive) data for the targeting process
  • Requirements for recommendation systems to be transparent as to their algorithms and clear as to what aspects of those algorithms the users can opt in or out of
  • Special obligations for very large online platforms
  • An ability for academic researchers to access key data from the largest platforms to understand online risks and their evolution
  • An oversight structure supported by a new European Board for Digital Services

Application

The DSA covers all intermediary services (hosting services, caching services and online platforms) that are provided to recipients located in the EU. There is a layered approach within the DSA to the imposition of obligations on various subsets of intermediary services. Very large online platforms, a group that includes most well used social media platforms, are under the heaviest compliance burden due to their reach. As facilitators of public debate, economic transactions, and the dissemination of information, opinions and ideas, they are recognised to have great influence which could be abused.

Providers of hosting or other services caught by the DSA should carefully scrutinise their obligations under the legislation. While the DSA provides that an intermediary service provider will not be liable in relation to any illegal content that is provided to them by a recipient of their service, compliance failures in relation to the recipient’s use of the service can cause that immunity to be lost. Therefore, ISPs reporting mechanisms and take down processes may need to be developed or overhauled.

User rights are also in the spotlight. Effective internal complaint handling systems must be provided, free of charge, to recipients of an online platform’s services. This includes the ability to access out-of-court dispute settlement mechanisms and online platforms must engage with such procedures in good faith.

The DSA came into force on 16 November 2022. Online platforms now have three months to report the number of active end users on their websites. Based on these user numbers, the European Commission will assess whether a platform should be designated a very large platform or search engine. Most provisions, though, will apply to online intermediary service providers from February 2024.

Impact on UK businesses

UK providers of hosting and other intermediary services to the EU market should consider which layers of DSA obligations are likely to apply to their services. For EU-facing businesses, the DSA is an opportunity to check overall data compliance. Complaints processes will need to be adjusted, EU-based legal representatives appointed, vetting processes for online traders improved and, where relevant, changes may be needed to the display of advertising content.

Roles and responsibilities when handling regulator requests and questions should also be reviewed. This is particularly important given the potential for significant fines if a business supplies incorrect, incomplete or misleading information to the regulator, or fails to reply.

Our articles explained

All our articles and blogs are correct on the date they’re published but please don’t rely on them as legal advice. If you’d like to speak to us about your own legal requirements, please contact one of our expert lawyers.

Mills & Reeve Sites navigation
A tabbed collection of Mills & Reeve sites.
Sites
My Mills & Reeve navigation
Subscribe to, or manage your My Mills & Reeve account.
My M&R

Visitors

Register for My M&R to stay up-to-date with legal news and events, create brochures and bookmark pages.

Existing clients

Log in to your client extranet for free matter information, know-how and documents.

Staff

Mills & Reeve system for employees.