European Commission Starts Using Powers Under The Digital Services Act

The European Commission has begun using its powers under the Digital Services Act in earnest. Action ranges from initial information requests, to formal investigative proceedings, including action based on civil society complaints received. I've summarised the scope of the DSA at the end of this note, which is for information purposes only. These investigations would also benefit UK businesses providing services to EU/EEA residents. If you would like advice on any aspects, please let me know.

Following earlier information requests to AliExpress, the Commission has launched a formal investigation into a long list of potential failures and resulting infringements. I don't recommend even clicking on the AliExpress site to check it out.

Ominously, the Commission also wants more information on how some very large online search engines and other platforms mitigate the risks of creating and spreading information using generative AI, such as ‘hallucinations', deepfakes and the automated manipulation of services to mislead voters; as well as questions covering electoral processes, illegal content, protection of fundamental rights, gender-based violence, protection of minors, mental well-being, protection of personal data, consumer protection and intellectual property. Bing, Google Search, Facebook, Instagram, Snapchat, TikTok, YouTube, and X/Twitter have until 5 April 2024 to respond on questions related to elections and 26 April 2024 for the other queries. There were also previous requests to Meta regarding 'pay or consent' models for Facebook and Instagram, as well as 'shadow banning' and the launch of Threads.

And, based on a civil society complaint, the Commission has also fired a shot across the bows of LinkedIn, by asking for more details on how it complies with the prohibition on presenting ads by profiling special categories of personal data, such as sexual orientation, political opinions, or race., how it ensures that all necessary transparency requirements for advertisements are provided to its users, including basic information about the nature and origins of an ad and the ban on presenting advertisements based on profiling using special categories of personal data. LinkedIn also has until 5 April 2024 to respond. 

As explained previously, the DSA establishes a harmonized approach to protecting EU-based users of online communication, e-commerce, hosting and search services across the EU, by granting intermediary service providers (“ISPs”) exemption from certain liability if they perform certain obligations. An ISP will be in scope if it is either based in the EU or has a substantial connection with the EU (a significant number of users as a proportion of the population or by targeting its activities at one or more Member States). There are extra requirements for ISPs with at least 45m average monthly active EU users (designated as ‘very large online’ (VLO) platforms and VLO search engines). There are some exemptions for small enterprises and micro-enterprises.

These investigations would also benefit UK businesses providing services to EU/EEA residents. This post is for information purposes only. If you would like advice on any aspects, please let me know.