On February 17, 2024, the Digital Services Act (DSA) became fully applicable in the European Union (EU). The DSA, which has been portrayed as Europe’s new “Digital Constitution,” sets out a cross-sector regulatory framework for online services and regulates the responsibility of online intermediaries for illegal content. Against this background, this chapter provides a brief overview of recent regulatory developments regarding platform responsibility in the EU. The chapter forms part of the volume’s comparative research project focused on inconsistencies among jurisdictions, the international effects of national structures for responsibility, and the possibility of international coordination of reform. In this context, the chapter seeks to add a European perspective to the global debate about platform regulation. Section 3.1 provides an overview of the regulatory framework in the EU and recent legislative developments. Section 3.2 analyzes different approaches regarding the enforcement of rules on platform responsibility. Section 3.3 takes a closer look at the regulation of content moderation by digital platforms in the EU. Finally, Section 3.4 adds some observations on the international effects of EU rules on platform responsibility.
3.1 General Overview on Platform Responsibility
Platform responsibility in the EU is based on a combination of horizontal and sector-specific rules. For more than twenty years, the central pillar of the regulatory framework for digital services at EU level has been the E-Commerce DirectiveFootnote 1 (ECD).Footnote 2 Over the past few years, it has been complemented by sector-specific regulatory initiatives (Section 2). Furthermore, several Member States have recently enacted national laws imposing responsibility on platforms in specific subject areas (Section 3). With the proposal for a Digital Services Act (DSA),Footnote 3 published in December 2020, the European legislator has taken an important step toward a comprehensive reform of the regulatory framework for platform responsibility (Section 4). A political agreementFootnote 4 on the outline of the DSA was reached in April 2022 and the DSA was formally adopted in October 2022.Footnote 5
3.1.1 The E-Commerce Directive
The ECD, which laid the foundations for the EU regulatory framework for digital services, did not provide a positive basis for establishing when a provider of online services can be held liable for illegal content online. Instead, it created a horizontal framework of conditional exemptions from liability for different types of online service providers.Footnote 6 For hosting providers, including online platforms, legal immunity was based on a knowledge standard. Unlike Section 230 of the US Communications Decency Act,Footnote 7 which gives absolute immunity to publishers (other than immunity from Federal criminal law and certain intellectual property and sex trafficking claims), the ECD shielded platforms from liability only if they did not know that they are hosting illegal content. Under Art. 14 ECD, a platform operator was not liable for information stored at the request of a user, subject to the satisfaction of two alternative conditions. First, if “the provider does not have actual knowledge of illegal activity or illegal content.”Footnote 8 Second, if “the provider, upon obtaining such knowledge or awareness, acts expeditiously to remove or disable access to the illegal content.”Footnote 9 According to well-established case law of the European Court of Justice, the applicability of these safe harbor provisions depends on whether the intermediary has played a “neutral role” or an “active role.”Footnote 10 In the cases Google France v. Louis VuittonFootnote 11 and L’Oreal v. eBay,Footnote 12 the European Court of Justice has stated that the liability exemptions do not apply to service providers who play an active role, which would give the provider knowledge or control over the activity or information that is hosted. The safe harbor rule is complemented by Art. 15 ECD, which underlines that platform operators have no general obligation to monitor information on the platform.
3.1.2 Sector-Specific Legislation and Self-regulation at EU Level
In the light of the dynamic development of the digital economy over the past two decades, it became evident that the ECD in its present state no longer provides an adequate regulatory framework for the emerging “platform society.”Footnote 13 In response to the rise of large online platforms, the EU has adopted over the past few years a variety of regulatory initiatives, including sector-specific legislation and measures based on self-regulation. These initiatives, which were meant to complement the ECD, seek to provide a regulatory response to the increasingly complex digital environment and the dissemination of illegal and harmful content.Footnote 14 Some of them focus on specific services (e.g., audiovisual media services),Footnote 15 others address specific types of illegal content (e.g., illegal hate speech,Footnote 16 terrorist content).Footnote 17 Others again tackle the dissemination of content that is harmful, but not necessarily illegal (e.g., online disinformation).Footnote 18 This piecemeal approach added to the fragmentation of the regulatory landscape and failed to provide a comprehensive update of the ECD, in particular in terms of responsibilities and regulatory oversight.Footnote 19 A few examples may illustrate this sector-specific approach.
Hate speech. Regarding illegal hate speech, the EU opted for self-regulation by platforms. Thus, in May 2016, the European Commission published the EU Code of Conduct on Countering Illegal Hate Speech Online.Footnote 20 Initial signatories of the Code of Conduct included Facebook, Microsoft, Twitter, and YouTube. Today, the list of signatories also includes TikTok, LinkedIn, Twitch, and other platforms.Footnote 21 Considering that there is no formal definition of “hate speech” in International Human Rights Law, the Code of Conduct, adherence to which is voluntary, builds on the definition of illegal hate speech adopted by the Council of the European Union.Footnote 22 Under the Code of Conduct, the signatories made several voluntary commitments to counter the spread of illegal hate speech. In particular, they committed themselves to put in place mechanisms that allow them to review the majority of notifications on illegal content submitted by users within twenty-four hours and remove or disable access to such content, if necessary. In addition, platforms pledged to intensify cooperation between themselves and other platforms and social media companies to enhance best practice sharing. The implementation of the Code is evaluated through regular monitoring rounds. The performance reports are published by the European Commission.Footnote 23
Disinformation. Another subject area, where the EU has promoted platform self-regulation, is the fight against disinformation. In September 2018, the European Commission released the Code of Practice on Disinformation,Footnote 24 under which the signatories (including Facebook, Google, Twitter, TikTok, and several advertising industry associations) voluntarily commit to take measures to minimize the spread of online disinformation. In order to coordinate these efforts, the Code of Practice contains a wide range of commitments: from transparency requirements for political advertising, to the termination of fake accounts, to the demonetization of disinformation campaigns.
Following a revision process launched in 2021, a revised and strengthened Code of Practice was released in June 2022 by the European Commission. It is planned that the new Code of Practice shall become part of a broader regulatory framework in combination with the future DSA. In particular, for very large platforms (VLOPs)Footnote 25 and very large search engines (VLOSEs)Footnote 26 with at least forty-five million average monthly active users, adherence to the Code of Practice will constitute a risk mitigation measure required under Art. 27 DSA. In 2023, the EU adopted two series of designation decisions under the DSA designating twenty VLOPs and two VLOSEs.Footnote 27 Following their designation, the companies will have to comply with the full set of new obligations under the DSA. The examples above show that the DSA will not entirely replace the existing regulatory instruments but rather incorporate them into a more comprehensive governance framework that combines horizontal and sector-specific rules, as well as binding and non-binding instruments.
Terrorist content. The controversial EU Regulation on addressing the dissemination of terrorist content online (TCO Regulation),Footnote 28 which came into force in June 2021, establishes uniform rules to address the misuse of hosting services for the dissemination to the public of terrorist content online, which have direct effect across the EU as of June 7, 2022. Under the TCO Regulation, hosting service providers, including social media platforms, video-sharing services, and cloud services, may be required to remove flagged “terrorist content”Footnote 29 across the entire EU within specific time frames.
Notably, national authorities have the power to issue “removal orders” requiring hosting service providers to remove or disable access to terrorist content in all EU Member States “as soon as possible and, in any event, within one hour of receipt of the removal order.”Footnote 30 In addition, the TCO Regulation includes a number of measures to ensure transparency, accountability, and the protection of legal rights. For example, platforms will have the right to challenge a removal order in court.Footnote 31 Furthermore, they must put in place complaint-handling mechanisms that allow users whose content has been removed to request a reinstatement of the content.Footnote 32
When the DSA entered into force, it did not replace the TCO Regulation. Instead, the DSA explicitly mentions the TCO Regulation in the list of sector-specific legislation that will continue to apply as lex specialis.Footnote 33 The same applies to the Audiovisual Media Services Directive, which was revised in 2018 and contains new rules on how video-sharing platforms (e.g., YouTube) shall deal with illegal content.Footnote 34
3.1.3 Regulatory Initiatives of the Member States
It is not only the European legislator who has contributed to making the regulatory landscape in Europe increasingly complex through sector-specific regulation. Member States have also contributed to this by introducing national legislation on digital services and online platforms. For example, as the ECD does not contain any harmonized rules on notice-and-action procedures, several Member States have enacted such rules in their national legislation.Footnote 35 In addition, some Members more recently introduced strict requirements for platforms to remove specific types of illegal content (e.g., illegal hate speech) within a short time frame. A prominent and rather controversial example is the German Network Enforcement Act (NetzDG) of 2017, which stipulates due diligence obligations for social media platforms.Footnote 36 In particular, the NetzDG specifies that content that is “manifestly unlawful” must be removed or blocked within twenty-four hours of receiving a complaint.Footnote 37 Other examples of national platform laws that require the deletion of illegal content within short time limits include the Austrian Communication Platforms ActFootnote 38 and the French Loi Avia (although key provisions of the latter were struck down by the French Constitutional Council in June 2020).Footnote 39 These national initiatives and the growing risk of regulatory fragmentation was one of the main drivers of the European Commission’s effort to update the legislative framework for online platforms and ensure that platforms are regulated at the EU level.Footnote 40 In November 2023, the European Court of Justice decided that national laws may not subject a communication platform provider established in another Member State to general and abstract obligations (e.g., reporting obligations).Footnote 41 In its decision, the Court held that such a regulatory approach would be in breach of the ECD’s country-of-origin principle. This ruling further limits the regulatory options of Member States vis-à-vis online platforms.
3.1.4 The Digital Services Act
In December 2020, the European Commission published the then much-anticipated proposalFootnote 42 for a Digital Services Act (DSA) to update the regulatory framework for online platforms.Footnote 43 The proposal was part of a more comprehensive legislative package that also includes the Digital Markets Act (DMA).Footnote 44 Together, the DSA and the DMA create a new regulatory framework for the governance of digital services in the European Union.Footnote 45 The DMA aims at ensuring a contestable and fair market across the digital sector by stipulating ex ante rules applicable only to large online platforms that act as “gatekeepers”Footnote 46 between business users and end users.Footnote 47 In contrast, the DSA has a much broader scope and aims at updating the existing rules on platform responsibility for the provision of digital services.
3.1.4.1 General Framework of Platform Liability
Regarding platform liability, the DSA keeps up the conditional exemptions from liability of providers of online services.Footnote 48 One important difference compared to the ECD is that they will be contained in an EU Regulation, which unlike EU Directives requires no implementing legislation within individual Member States and therefore increases the level of harmonization.Footnote 49 Generally speaking, the DSA makes three contributions to the regulatory framework for content moderation by (1) setting out general rules of liability for providers of intermediary services; (2) establishing a regime of due diligence obligations, with a special focus on online platforms including social media; and (3) strengthening the cooperation between national authorities in charge of the public enforcement of online regulation.Footnote 50
The liability rules for providers of online intermediary services set out in Chapter II of the DSA form the legal backdrop for content-related decisions taken by platform operators and other providers of digital intermediary services.Footnote 51 These rules determine under which circumstances online intermediaries, such as ISPs, hosting providers, or social media platforms, are legally required to remove content. The DSA abstains from the difficult task of drawing a line between legal and illegal content. Instead, it defines a number of liability exemptions by establishing when a provider of online intermediary services cannot be held liable in relation to third-party content. The safe harbor regime of the DSA broadly follows the existing model of the ECD.Footnote 52
The DSA defines liability exemptions based on an intermediary’s specific functions: mere conduit,Footnote 53 caching,Footnote 54 and hosting.Footnote 55 For the first two categories of providers, the DSA establishes a broad liability exemption as long the providers are “in no way involved with the information transmitted.”Footnote 56 In contrast, for hosting providers, legal immunity is based on a knowledge standard. In other words, the DSA shields hosting providers from liability only if they do not know that they are hosting illegal content. This general rule is supplemented by two important limitations: First, Member states must not impose a general obligation to monitor content on providers.Footnote 57 Second, it incorporates a Good Samaritan rule, whereby providers who carry out self-initiated investigations in order to detect and remove illegal content will not lose their liability exemption for this reason alone.Footnote 58
3.1.4.2 Due Diligence Obligations
The above liability rules are complemented by several due diligence obligations for online intermediaries. Because of the broad range of intermediary services covered by the new rules, the DSA does not apply a one-size-fits-all approach. Instead, it follows a “risk-based approach” and formulates a catalog of “asymmetric due diligence obligations.”Footnote 59 In doing so, the DSA distinguishes four levels of regulation:
Level 1 contains a basic set of rules, which applies to the broadest category, that is, all providers of online intermediary services. This category includes all providers of mere conduit, caching and hosting services.Footnote 60
Level 2 applies to all providers of hosting services, such as cloud storage providers and webhosting services.Footnote 61
Level 3 contains some additional provisions that apply only to online platforms,Footnote 62 defined as a provider of hosting services that, at the request of a recipient of the service, stores and disseminates to the public information.Footnote 63 This category includes online marketplaces, social networks, and app stores.
Level 4 adds some specific due diligence obligations for “very large online platforms” (VLOPs), and “very large online search engines” (VLOSEs), which have more than forty-five million average monthly EU users (i.e., roughly 10 percent of EU citizens).Footnote 64 In contrast, very small platforms are exempt from most due diligence obligations.Footnote 65
This model of asymmetric regulation, under which the rules become more numerous and stricter as we go from Level 1 to Level 4, is an expression of the principle of proportionality. In terms of substance, the DSA introduces, for the first time, a number of due diligence obligations with regard to content moderation. For example, all providers of online intermediary services have to include information about their content moderation policy in their terms and conditions.Footnote 66 They also have to publish annual reports with meaningful and comprehensive information about their content moderation activities, including details on the use of automated tools for content moderation (Level 1).Footnote 67 In addition to these general requirements, providers of hosting services must provide harmonized notice-and-action mechanisms and justify removal decisions with a statement of reasons (Level 2).Footnote 68 Providers of online platforms must also provide users with meaningful possibilities to challenge decisions to remove or label content via an internal complaint system and an external out-of-court dispute resolution mechanism (Level 3).Footnote 69 Finally, VLOPs and VLOSEs are subject to additional rules to ensure more comprehensive public oversight of their content moderation practices (Level 4). In particular, VLOPs and VLOSEs are obliged to develop appropriate tools for assessing and managing systemic risks and take measures to protect the integrity of their services against manipulation, including disinformation campaigns or interference with electoral processes.Footnote 70
Most of the rules regarding content moderation in the DSA have been drafted with user-facing platforms such as Facebook, Twitter, or YouTube in mind. But the DSA also responds to the expansion of content moderation practices by expanding its content moderation rules, both in the horizontal and vertical dimensions.Footnote 71 In this sense, some of the content moderation rules stipulated by the DSA apply also to nontraditional platforms (e.g., public groups on messaging services) and to actors deeper down in the content moderation stack (e.g., cloud services, content delivery networks).
3.2 Enforcement of Platform Responsibility Rules
Enforcement of platform responsibility was a weak spot of the ECD, which mainly relied on self-regulatory initiatives and gave Member States wide discretion regarding the choice of enforcement methods (Section 1).Footnote 72 In contrast, the DSA puts a strong emphasis on procedural aspects and enforcement.Footnote 73 In doing so, it combines different methods including self-regulation and administrative liability (Section 2).
3.2.1 The E-Commerce Directive: Self-regulation and Wide Discretion for Member States
The ECD did not provide for an effective oversight and enforcement framework at the European level. Instead, it merely suggested that the European Commission and Member States encourage the drawing up of codes of conduct by trade, professional, and consumer organizations.Footnote 74 Examples of such codes are the above-mentioned EU Code of Practice on Disinformation,Footnote 75 the EU Code of conduct on countering illegal hate speech online,Footnote 76 and the EU Product safety pledge.Footnote 77 With regard to civil liability and private rights to sue, the ECD only vaguely instructs Member States to “ensure that court actions available under national law allow for the rapid adoption of measures, including interim measures, designed to terminate any alleged infringement and prevent any further impartment of the interests involved.”Footnote 78 Regarding administrative enforcement, the ECD mainly limits itself to stipulating that “Member States shall have adequate means of supervision and investigation necessary to implement” the ECD.Footnote 79 Similarly, the ECD does not prescribe which type of sanctions Member States shall apply to infringements of national provisions implementing the ECD. Instead, the choice of sanctions is left to the discretion of Member States. Using the standard formula of EU Directives, the ECD merely stipulates that those sanctions shall be “effective, proportionate and dissuasive.”Footnote 80
3.2.2 The Digital Services Act: Strong Emphasis on Oversight, Enforcement, and Sanctions
Unlike the ECD, the DSA puts a strong emphasis on oversight and enforcement and devotes a detailed chapter on “implementation, cooperation, sanctions and enforcement.”Footnote 81 Generally speaking, the enforcement of the due diligence obligations imposed by the DSA on platforms is shared between Member States and the European Commission. For starters, the Member State where the platform has its main establishment will have exclusive powers for the supervision of the DSA rules, except where such powers are attributed to the exclusive or shared competence of the European Commission.Footnote 82 In particular, the European Commission is granted exclusive powers regarding the specific obligations set out in Section 4 Chapter III DSA, which apply only to large online platforms (VLOPs) and very large online search engines (VLOSEs). For fulfilling this role, the Commission is granted far-reaching powers of investigation, enforcement, and monitoring (similar to those in antitrust cases) in respect of VLOPs and VLOSEs.Footnote 83 In December 2023, the European Commission has opened formal proceedings against the social media platform X (formerly Twitter) in order to investigate whether X may have breached its obligations under the DSA regarding risk management, content moderation, dark patterns, advertising transparency, and data access for researchers.Footnote 84
For coordinating the enforcement of the DSA, each Member State must appoint a Digital Services Coordinator (DSC).Footnote 85 The DSC will be an independent authority responsible for supervising platforms and other intermediary services in their Member State and for coordinating supervision by sectoral authorities. It is envisaged that national DSCs and the Commission cooperate closely and provide each other mutual assistance in the enforcement of the DSA. Cooperation between DSCs shall be facilitated by the setting up of a European Board for Digital Services, which consists of all national DSCs and the European Commission.Footnote 86
The DSA is also more explicit with regard to the type of sanctions that may be imposed in case of infringements. In particular, the DSA states that the competent enforcer – the DSC or the European Commission, as the case may be – can, in the most serious cases, impose a fine of up to 6 percent of the total worldwide annual turnover in the preceding financial year.Footnote 87 Moreover, periodic penalty payments of up to 5 percent of the average daily income or worldwide annual turnover in the preceding financial year per day may be imposed.Footnote 88
As this brief overview shows, the DSA focuses on public enforcement and introduces a centralized regulatory model for VLOPs and VLOSEs with the Commission as the primary regulator. The choice of this model seems to be influenced by the difficulties that have arisen in enforcing the General Data Protection RegulationFootnote 89 (GDPR).Footnote 90 In particular, it occurred that some national data protection authorities were rather slow to respond to complaints and requests for cross-border cooperation by authorities from other Member States. Against this background, the DSA also establishes a detailed cooperation mechanism that seeks to ensure that the enforcement of the DSA will not be compromised by an inactive DSC. In particular, in case of disagreement among DSCs, the European Board for Digital Services may refer the matter to the Commission in order to speed up the enforcement procedure.Footnote 91
While the DSA focuses on administrative enforcement, it is important to note that the public enforcement model is complemented also by other methods of enforcement. In this sense, Art. 54 DSA, which was introduced only during the trilogue negotiations between the European Commission, the European Parliament, and the Council of the European Union, underlines that platform users “shall have the right to seek, in accordance with Union and national law, compensation from providers of intermediary services, against any damage or loss suffered due to an infringement by those providers of their obligations” under the DSA. In other words, a violation of the due diligence obligations stipulated by the DSA may also give rise to civil liability. However, the DSA leaves the details of such individual claims to the laws of the Member States. Finally, violations of the DSA may also give rise to class actions (or, more precisely, “representative actions”) under Directive (EU) 2020/1828.Footnote 92
3.3 Specific Platform Responsibilities regarding Content Moderation
Content moderation by digital platforms has become a focal point of the policy debate on platform regulation.Footnote 93 Some argue that platforms are not doing enough to reduce the dissemination of illegal or harmful content. Others criticize platforms for exercising too much censorship. Against this background, this section will explain how the DSA regulates content moderation by platforms, in particular the scope of platform responsibility for detection and moderation, and limits on platform discretion to moderate.
3.3.1 General Framework: No General Monitoring Obligations and Good Samaritan Rule
The DSA defines content moderation as “activities, automated or not, undertaken by providers of intermediary services that are aimed, in particular, at detecting, identifying and addressing illegal content or information incompatible with their terms and conditions, provided by recipients of the service.”Footnote 94 As mentioned before, such activities to detect and moderate specific types of content are not only taken by operators at the platform level but also deeper down in the internet stack at the infrastructure level.Footnote 95 The definition provided by the DSA is rather broad in two respects: first, it not only covers decisions to remove content and disable user accounts but also other measures that influence the “availability, visibility and accessibility” of content, such as downranking and de-amplification. Second, the definition is not limited to “illegal content” but also includes measures taken with regard to information which is incompatible with the terms and conditions of the online service provider. Therefore, content moderation under the DSA includes also measures taken regarding content that is legal but nevertheless considered objectionable.
As explained in Section 3.1, the DSA establishes a knowledge-based limited liability regime that is built around a notice-and-action mechanism. These rules determine under which circumstances online intermediaries, including social media platforms, are legally required to remove content. In this sense, the liability rules for providers of online intermediary services form the legal backdrop for content-related decisions taken by online platforms.Footnote 96 Another key provision that determines the legal framework for content moderation decisions is Art. 8 DSA, which underlines that “no general obligation to monitor the information which providers of intermediary services transmit or store, nor actively to seek facts or circumstances indicating illegal activity shall be imposed on those providers.” While any “general obligation” to monitor is prohibited, courts may impose “specific obligations” to monitor activities on the platform in order to tackle repeat infringers or the reappearance of identical or content with “equivalent meaning.”Footnote 97
A notable addition to the EU regime of platform liability is Art. 7 DSA, on “voluntary own-initiative investigations.” According to Art. 7 DSA, online intermediaries will not automatically lose the conditional exemption from liability “solely because” they carry out voluntary investigations or take other measures for “detecting, identifying and removing, or disabling access to, illegal content” or “take the necessary measures to comply with” requirements of national law or EU law, including those set out in the DSA. The purpose of Art. 7 DSA is to incentivize online intermediaries to engage in voluntary content moderation of harmful and illegal content by introducing a sort of “Good Samaritan” protection.Footnote 98 It is unclear, however, whether this aim will be achieved. In particular, the scope of the protection offered by Art. 7 DSA will need further clarification. During the trialogue negotiations between the European Commission, the European Parliament, and the Council of the European Union, the wording of the provision has been amended to the effect that voluntary own-initiative investigations are only covered by the Good Samaritan protection if they are carried out “in good faith and in a diligent manner”. It is unclear, however, which level of diligence is required with regard to content moderation activities by platforms. At least some clarification is provided by Recital 26 of the DSA, which underlines that the condition of acting in good faith and in a diligent manner should include “acting in an objective, non-discriminatory and proportionate manner and with due regard to the rights and legitimate interests of all parties involved.” While the DSA does not formulate an explicit requirement of platform neutrality, the reference to the principle of nondiscrimination makes it clear that an arbitrary unequal treatment of content within the framework of content moderation would be a violation of the due diligence requirements.
3.3.2 Asymmetric Due Diligence Obligations: Risk-Based Approach to Content Moderation
In addition to the general rules set out in Arts. 7–8 DSA, there are a number of more specific rules on content moderation that are scattered throughout the DSA. These rules stipulate graduated due diligence obligations regarding content moderation depending on the type and size of intermediary. In this sense, they follow the asymmetric model (“risk-based approach”) of the DSA.
3.3.2.1 Transparency and Reporting
According to Art. 14(1) DSA all providers of intermediary services, including social media platforms, must provide in their terms and conditions “information on any restrictions that they impose in relation to the use of their service.” This information shall include details on “any policies, procedures, measures and tools used for the purpose of content moderation, including algorithmic decision-making, and human review as well as rules of procedure of their internal complaint handling system.”
These general transparency requirements are supplemented by Art. 15 DSA, which stipulates detailed reporting obligations.Footnote 99 In particular, it requires providers of intermediary services to publish a yearly report on any content management they engaged in during the relevant time period.Footnote 100 This report shall provide “meaningful and comprehensible information about the content moderation engaged in at the providers’ own initiative.”Footnote 101 Furthermore, detailed information about the use of “automated means for the purpose of content moderation” must be included in the report.Footnote 102
On September 26, 2023, the European Commission launched the DSA Transparency Database, a first-of-its-kind platform that collects data in accordance with Art 25(5) of DSA and provides public access to content moderation decisions made by online platform providers in the EU. This initiative aims to enhance online transparency and accountability.Footnote 103
3.3.2.2 Fundamental Rights and Proportionality
The DSA not only stipulates transparency and reporting requirements regarding content moderation policies but also regulates how providers of intermediary services shall implement their content moderation procedures. Pursuant to Art. 14(4) DSA, they “shall act in a diligent, objective and proportionate manner in applying and enforcing the restrictions” referred to Art. 14(1), “with due regard to the rights and legitimate interests of all parties involved, including the fundamental rights of the recipients of the service, such as the freedom of expression, freedom and pluralism of the media, and other fundamental rights and freedoms as enshrined in the Charter.”Footnote 104 In other words, Article 14(4) DSA sets a benchmark for content moderation decisions by providers at all levels of the content moderation stack. All providers of intermediary services are obliged to take due consideration of fundamental rights enshrined in the EU Charter of Fundamental Rights (CFR),Footnote 105 particularly the freedom of expression and information, the freedom to conduct a business, and the right to nondiscrimination.Footnote 106
Similarly, Recital 47 of the DSA underlines that the design, application, and enforcement of content-related restrictions should be “non-arbitrary and non-discriminatory.” It remains to be seen whether these references to the principle of nondiscrimination will be interpreted by the European Court of Justice as the legal foundation of a requirement of neutrality with regard to content moderation. In this context, it might also be of interest that during the legislative process, a possible prohibition of content moderation for media content was discussed.Footnote 107 On the one hand, it was argued that such a prohibition could strengthen the independence of the media, but, on the other hand ,it could undermine the goal of tackling disinformation. Finally, the proposed ban was not included in the text of the provisional agreement on the DSA.
3.3.2.3 Notice-and-Action Mechanism and Complaint Handling
The DSA requires providers of hosting services, including providers of online platforms, to set up a user-friendly electronic notice-and-action mechanism that allows “any individual or entity to notify them of the presence on their service of specific items of information that the individual or entity considers to be illegal content.”Footnote 108 This mechanism shall enable users to notify hosting service providers of allegedly illegal content. If such a notice is sufficiently substantiated and fulfills the requirements set out in Art. 16(2) DSA, the provider is considered to have actual knowledge of the illegal activity. This triggers application of the liability rule under Art. 6 DSA. In other words, the hosting service provider will be liable for the illegal content unless the provider “acts expeditiously to remove or to disable access to the illegal content.”Footnote 109 However, providers are only deemed to have actual knowledge of the illegal content where the notices “allow a diligent provider of hosting services to identify the illegality of the relevant activity or information without detailed legal examination.”Footnote 110 If a hosting provider decides to remove or disable access to the illegal content or otherwise restricts the visibility of specific items of information, Art. 17 DSA obligates the host to provide the uploader of that content with a detailed statement of reasons for removal.Footnote 111
For online platforms, the DSA adds a further element to increase the effectiveness of the notice-and-action mechanism. Pursuant to Art. 22(1) DSA, providers of online platforms shall take the necessary technical and organizational steps to cooperate with specialized “trusted flaggers” (e.g., consumer organizations or other NGOs) and to ensure that notices provided by them are decided upon with priority.Footnote 112 Providers of online platforms are also obliged to set up an internal complaint-handling system, which enables users to lodge a complaint against decisions to remove content or terminate the service.Footnote 113 Furthermore, users who are affected by the provider’s decision must be given the opportunity to appeal the decision to an impartial dispute resolution body whose decision is binding on the platform provider.Footnote 114
3.3.2.4 Systemic Risk Management
For very large online platforms (VLOPs) and very large online search engines (VLOSEs), the DSA provides even more extensive regulations.Footnote 115 They will be required to undergo annual risk assessments to identify any significant systemic risks stemming from the services.Footnote 116 The scope of this risk assessment includes the “dissemination of illegal content,” “any actual or foreseeable negative effects for the exercise of fundamental rights,” and “any actual or foreseeable negative effects on civic discourse and electoral processes, and public security.”Footnote 117 When assessing such systemic risks, several factors shall be taken into account, including the design of recommender systems and “other relevant algorithmic systems”Footnote 118 as well as the functioning of the content moderation systems.Footnote 119
In order to counter the above-mentioned systemic risks, VLOPs and VLOSEs must put in place reasonable, proportionate, and effective mitigation measures. Such measures may include adapting their content moderation systems (e.g., by adjusting the speed and quality of processing notices related to specific types of illegal content) or by adjusting their terms and conditions.Footnote 120 The effectiveness of these measures will be assessed at least annually by an independent audit.Footnote 121 Furthermore, VLOPs and VLOSEs are required to publish transparency reports every six months, as opposed to once a year.Footnote 122
Influenced by the conflict in Ukraine, a new “crisis response mechanism” was introduced into the final version of the DSA during the trialogue negotiations,Footnote 123 which sparked a controversial debate.Footnote 124 Under this provision, the European Commission may require VLOPs to react to a public security or public health crisis by initiating an urgent crisis response. For example, VLOPs could be required to intensify their fight against the dissemination of disinformation. Such measures may include, for example, “adapting content moderation processes and increasing the resources dedicated to content moderation.”Footnote 125 Similarly, VLOPs may be obliged to take “awareness-raising measures” and promote “trusted information.”Footnote 126
3.4 International Aspects of Platform Responsibility
This final section will briefly address three aspects that may be of particular relevance for US readers: the application of EU platform responsibility rules to platform operators based outside the EU (Section 1), the obligation to designate a legal representative in the EU (Section 2), and the global reach of court orders to remove certain content (Section 3).
3.4.1 Application to Foreign-Based Platforms
The DSA will have extraterritorial reach beyond the EU. More precisely, the rules set out in the DSA will apply to all intermediary service providers, irrespective of their place of establishment, to the extent that they provide services to users in the EU.Footnote 127 Whether the intermediary services are provided in the EU is determined by a “substantial connection” test. A substantial connection is deemed to exist where the provider either has an establishment in the European Union or, its absence, on the basis of the existence of a significant number of users in the EU or the targeting of activities toward one or more EU Member States.Footnote 128 This regulatory approach follows the model of other EU instruments such as the GDPRFootnote 129 and the Regulation on addressing the dissemination of terrorist content.Footnote 130
3.4.2 Requirement to Designate a Legal Representative in the EU
The extraterritorial application of the DSA would fail in practice if the competent authorities were unable to enforce the rules against a platform operator that does not have an establishment in the EU. Therefore, the DSA requires service providers based outside the EU to designate a legal representative in one of the EU Member States.Footnote 131 The representatives shall not merely be a “mailbox” for communications by Member States’ authorities, but they can be held liable for noncompliance with the obligations under the DSA.Footnote 132 Similar obligations to designate a “representative” or a “responsible person” have been stipulated in other EU laws with an extraterritorial reach, such as the General Data Protection Regulation,Footnote 133 the Market Surveillance Regulation,Footnote 134 and the recent proposal for a General Product Safety Regulation.Footnote 135 Also the Regulation on addressing the dissemination of terrorist content online requires platforms that do not have their main establishment in the EU are required to designate a legal representative in the EU “for the purpose of the receipt of, compliance with and the enforcement of removal orders and decisions issued by the competent authorities.”Footnote 136
3.4.3 Global Reach of Court Orders to Remove Content
Another issue that may be of interest from a US perspective is the territorial scope of court orders to remove content. In this context, the recent decision of Court of Justice of the European Union (CJEU) in Glawischnig-Pieczik v. Facebook gave rise to concern.Footnote 137 In the case, which concerned a defamatory post on Facebook, the Austrian Supreme Court issued a preliminary ruling request to the CJEU. Among other things, the CJEU was asked whether a national court could extend an injunction against Facebook so that it had effect worldwide. The CJEU dealt with this question rather briefly and underlined that the ECD does not impose any territorial limitation on the scope of the measures that Member States are entitled to adopt. Therefore, the CJEU argued that the ECD “does not preclude those injunction measures from producing effects worldwide.”Footnote 138 However, as the Court underlined, it is necessary to take due account of the relevant international law.Footnote 139 Unfortunately, the CJEU did not further elaborate on how a worldwide effect could be reconciled with public and private international law. This was a missed opportunity considering that only a few days earlier, in Google France v. CNIL, the CJEU had decided that a de-referencing request based on the “right to be forgotten” under Art. 17 GDPR does not oblige a search engine to carry out a worldwide de-referencing.Footnote 140
Open access