EU turns the screw on Big Tech: the Digital Services Act Package

At EU level, there are two legislative proposals:

• A Digital Services Act, which is the measure likely to have the widest application in practice, setting out new rules for ISPs, cloud and webhosting services, online marketplaces, app stores, search engines and social networks. The proposal also contains a more stringent set of rules which will apply to "Very Large Online Platforms", which have at least 45 million users in the EU; and
  
  
• A Digital Markets Act, which is aimed at regulating larger tech businesses which are regarded as having "gatekeeper" status. The majority of tech businesses are likely to be outside its scope – although since many businesses (both within the tech sector and outside it) have to interact with the "gatekeepers" that the Act seeks to regulate, it is still likely to be of interest to them.

As explained in Section 4, similar proposals are being put forward in the UK – so Brexit will not mean that UK tech firms are off the hook.

Timing

The proposals have been drafted as EU Regulations which, once formally approved, will be directly applicable in Member States without the need for further implementing legislation at national level.  It will nevertheless take time for the proposals to work their way through the EU legislative process and once that has happened, EU Member States are likely to need to make some changes at national level in order to give effect to the Regulations;  for example, they will need to create or nominate bodies to act as national regulators (known as Digital Services Coordinators), in much the same way that each Member State has a national regulator for data protection under the EU General Data Protection Regulation (GDPR).  As a result, it is likely to be some time before these proposals become applicable - possibly years.

The Digital Services Act builds upon the E-commerce Directive, which was adopted in 2000 to address the growth of the Internet at that point in time. It will update and create a harmonised set of rules across a range of areas outlined below and give regulators new powers, including the ability to impose significant fines.

Addressing illegal content

The Digital Services Act preserves the liability regime set out in the E-commerce Directive for online intermediaries which exempts them from liability for the content they manage, provided they fulfil certain conditions.  However, it puts greater onus on hosting providers and platforms to provide notice and take down mechanisms so that those who do consider content illegal, can notify as such with greater confidence that something will be done about it.  Platforms will also have to establish complaint handling systems enabling users to contest the outcome of content moderation, deal with dispute settlement bodies, suspend repeat infringers, and have systems in place to prioritise notifications made by 'trusted flaggers'.

More onerous obligations for online platforms

In addition to the measures relating to illegal content outlined above, online platforms (including online marketplaces, app stores and so on) will also face a range of new obligations including:

• Transparency – for example, they will have to include information in their terms and conditions on any restrictions they impose on the use of data provided by users – such as the policies, processes, mechanisms and tools they use for the purpose of content moderation, or any algorithmic decision-making that they rely on. Platforms must also be transparent about online advertising, for example by making it clear to users when they are placing online adverts, on whose behalf they are doing so, and the reasons for targeting a user with the specific ad.
  
  
• Due diligence – online platforms which allow consumers to contract with traders, will have to carry out "know your trader" checks before allowing them to operate via the platform, to ensure greater traceability for example, of sellers of illegal goods and services.
  
  
• EU representative - in a measure reminiscent of GDPR style obligations, online intermediaries which operate within the EU, but from a location outside, will have to appoint EU based representatives to co-operate with supervisory authorities.

New regulators with new powers

The Digital Services Act will also create a new network of national regulators, known as Digital Services Coordinators, with powers including the ability to impose fines (see textbox), investigate complaints, carry out on-site inspections and require provision of information. The European Commission will have the same powers with respect to very large online platforms. A European Board for Digital Services will also be created with a view to ensuring consistent application of the Act across the EU.

The Digital Markets Act applies to "gatekeeper platforms". It is designed to ensure that they operate fairly and don't abuse the market power that they hold as gatekeepers.

What the legislation seeks to prevent

Examples of unfair practices by gatekeepers which the Act prohibits include:

• treating products or services that they offer directly more favourably in ranking than those of the third party traders which use their platforms;
  
  
• preventing customers from linking up to businesses outside their platforms; and
  
  
• preventing users from uninstalling pre-installed software or an app if they wish to do so.

There will also be obligations preventing gatekeepers from imposing exclusivity provisions on traders, and requiring them to permit access by their business users to the data that they generate on their platforms. In addition, gatekeepers will be obliged to permit a certain amount of interoperability between their own systems and third party software / operating systems, as long as the interoperability does not endanger the integrity of the gatekeeper's own systems.

By the time the proposals are formally implemented, the UK will have long exited the EU, and therefore they won't form part of UK law.  However, UK online intermediaries and platforms which offer their services in the EU will have to comply, including (as the proposals stand) by appointing EU based representatives.  Businesses which just operate in the UK are not off the hook either, as they face several proposed measures aimed at addressing similar concerns.

Tackling online harms

The UK Government has very recently published its full response to the 2019 Online Harms White Paper.  This sets out plans to impose a new duty of care and regulatory framework on any company which allows users to share or discover user generated content or interact with each other online (i.e. social media platforms, hosting providers, file hosting sites and online discussion forums) to make them take more responsibility for the safety of their users, and tackle harm caused by content or activity on their services.

Tackling "gatekeeper" businesses

In addition, in response to the Competition and Markets Authority's final market study report into online platforms and digital advertising markets, the Government announced the setting up of a dedicated Digital Markets Unit to oversee a pro-competition regime for platforms that currently dominate the market, such as Google and Facebook, and introduce and enforce a new code to govern their behaviour when interacting with competitors and users.

For more discussion of the European Commission's approach to data (particularly consumer data) in a competition law context, see this article.