The Digital Services Act (DSA), which entered into force in November 2022, establishes a framework for an unprecedented level of transparency, accountability and fairness for digital services in the EU, writes Michael Madden of Mason Haye & Curran LLP.

Who is covered?

The DSA applies to ‘intermediary services’, the definition for which includes a wide range of online services. In terms of the obligations that apply, the DSA distinguishes between the following categories of intermediary service, with each subsequent category subject to more onerous obligations reflecting their role, size and impact in the online ecosystem:

• ‘Caching’ and ‘mere conduit’ services, such as internet access providers.
• ‘Hosting services’ being services consisting of the storage of information provided by, and at the request of, a recipient of the service.
• ‘Online platforms’, being a subset of hosting services that also disseminate information to the public, such as social media and online marketplaces.
• Very large online platforms and search engines (VLOPs and VLOSEs), being online platforms and search engines which have an average monthly active user base in the EU of at least 45 million.

The DSA applies where recipients of a service are based in the EU, regardless of the service provider’s place of establishment.

Significant obligations

Examples of some of the more significant obligations imposed by the DSA include that:

In Association with

• All services will be required to respond to orders to act against illegal content on their services and inform users of their actions. Terms and conditions will also need to be updated to reflect content moderation practices and service providers will be subject to new transparency reporting requirements.
• All hosting services must put in place ‘notice and action’ mechanisms to enable anyone to flag illegal content and to ensure that they act upon same in a timely manner.
• All online platforms must have an effective internal complaints-handling system and must put in place “appropriate and proportionate measures” to ensure a high level of privacy, safety and security of minors.
• Online marketplaces must also carry out ‘Know Your Business Customer’ checks. They must also take steps to inform consumers if illegal products or services were sold on the marketplace.
• VLOPS and VLOSEs have significant additional obligations including in relation to risk assessments, risk-mitigation measures and independent audits.

Ireland’s role

Ireland now has pan-EU regulatory responsibility for service providers that have their main EU establishment here, except for VLOPs and VLOSEs where the European Commission takes primary responsibility. National regulators known as Digital Services Coordinators (DSCs) have general responsibility for ensuring implementation and enforcement of the DSA.  A new Media Commission, to be established in March 2023, will be Ireland’s DSC under the DSA.

Timelines and next steps

The DSA will apply to most services from 17 February 2024. However, the DSA will apply to VLOPs and VLOSEs sooner than this.  It will apply to these services four months from designation as a VLOP or VLOSE, likely in Q3 2023.

Next steps for service providers:

• Consider whether your services are within scope.
• Internally, consider whether and to what extent you need to change systems and practices in order to facilitate compliance with the various requirements.
• Externally, consider whether and to what extent you need to adjust your user interface and terms and conditions.
• If you operate an online marketplace, consider whether you have processes for gathering and verifying identity information on traders.

We have extensive experience and are well placed to assist clients in navigating this novel and complex law. We help organisations understand whether and how the DSA applies to them and design effective compliance measures that have minimal impact on their business.

Michael Madden (pictured) is a Technology Partner at Mason Hayes & Curran LLP.

Visit mhc.ie/technology