On 16 November 2022, the DSA entered into force.1 The DSA establishes an EU-wide set of rules for intermediary services and online platforms, which imposes new obligations and requirements regarding the content that they host, transmit and make available to the public. In this regard, the DSA empowers regulators with broad investigative and enforcement powers to deal with non-compliance at the national and EU Digital Services Act to Revolutionize Legal Landscape for Online Intermediaries for more details. Now that the DSA entered into force, what are the next steps?
Expected Timeline
The DSA will be directly applicable throughout the EU to all concerned undertakings from 17 February 2024.2 However, concerned undertakings are expected to anticipate the effective implementation of the DSA before such date.
By 17 February 2023, and at least once every six months afterwards, online platforms will have to publish on their websites the number of average monthly EU active recipients of the service, over the past six months, and are invited to notify such number to the European Commission ("EC").3 The EC has published on 1st February non-binding guidance to help online platforms to publish such user numbers.4
Based on these numbers, the EC will designate which of these online platforms qualify as very large online platforms ("VLOPs") or very large online search engines ("VLOSEs") – i.e. which have at least 45 million users in the EU.5
Four months after their formal designation – i.e. possibly in Q3 or Q4 2023 – the obligations for VLOPs and VLOSEs will become applicable.6 They should notably provide the EC with the results of their first annual risk assessment and comply with the numerous obligations imposed on them by the DSA, notably by taking corresponding risk mitigation measures.7
By 17 February 2024, EU Member States will need to identify their Digital Services Coordinators – which will be the authority responsible for supervising intermediary services established in their territory.8 The EC is already the supervision and enforcement authority for VLOPs and VLOSEs under the DSA.9
European Commission's Ongoing Work
The EC is currently conducting three main initiatives (detailed below) to draft implementing acts and delegated acts – all relating to the investigation and enforcement powers, as well as to the provisions that apply to VLOPS and VLOSEs (supervisory fee, audits). However, many other initiatives still need to be taken by the EC, to facilitate the implementation of the DSA.10
Implementing regulation11
Such implementing act aims at further detailing rules applicable to the EC's investigatory and enforcement powers (Articles 69 to 72), hearings (Article 79) and negotiated disclosure of information (Article 79) with respect to VLOPs and VLOSEs. This act was expected to be published for feedback, and adopted, by the end of 2022, but is still upcoming.
Supervisory fee12
Pursuant to Article 43 and to ensure the effective supervision and enforcement of the DSA, the EC is empowered to charge VLOPs and VLOSEs an annual supervisory fee based on the annual estimated costs. The delegated act published on 22 December 2022 aims at setting up the detailed methodology and procedure for determining the estimated costs and calculating the individual fees. This act was published and received feedback until 19 January 2023, and is planned to be adopted in Q1 2023.
Independent audits13
Pursuant to Article 37, VLOPs and VLOSEs are subject to annual independent audits (at their own expense), in order to monitor and assess compliance with certain DSA obligations. The delegated act aims at setting out the necessary rules on the procedural steps, auditing methodologies and reporting templates for the audits to be performed in this respect. This act is expected to be published for feedback and adopted in Q3 2023.
Footnotes
1 Regulation (EU) 2022/2065 of the European Parliament and of the Council of 19 October 2022 on a Single Market for Digital Services and amending Directive 2000/31/EC (Digital Services Act).
2 Article 93(1). To be noted that, pursuant to Article 93(2), some of the DSA provisions already apply since 16 November 2022 (e.g. Articles 24 and 33(3-6), Chapter 4).
3 Article 24(2).
4 https://digital-strategy.ec.europa.eu/en/library/dsa-guidance-requirement-publish-user-numbers.
5 Article 33(3-6).
6 Article 92.
7 Risk management obligations and compliance officer; External and independent risk auditing and public accountability; Data sharing with authorities and researchers; Supervisory fee; Codes of conduct; User choice not to have recommendations based on profiling.
8 Article 49(3).
9 Article 56(2).
10 Expected implementing acts: Information-sharing system (Article 85), Transparency reporting obligations (Articles 15 and 24); Expected delegated acts: Access to data (Article 40); Expected guidelines: Trusted flaggers (Article 22), Dark patterns (Article 25), Online protection of minors (Article 28), Mitigation of specific systemic risks (Article 35), Repositories for online advertising transparency (Article 39).
11 Article 83. See also Section 4 of Chapter IV -- Supervision, investigation, enforcement and monitoring in respect of providers of VLOPs and of VLOSEs.
12 Article 43.
13 Article 37(7).
The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.