After a long wait, the big day finally arrived on Tuesday: the European Commission unveiled the proposal for the Digital Services Act and the Digital Markets Act.
The Digital Services Act involves a major overhaul of the rules for online intermediaries. These are virtually all parties in the Internet value chain: connectivity service providers, CDNs, hosting providers and online platforms all fall under this heading.
The Digital Markets Act is entirely new and aims to curb the market power of so-called "gatekeepers. Think of parties like Google, Facebook, Amazon, etc. They are given far-reaching obligations to make the online playing field fairer.
Below are brief highlights of some of the new regulations.
The rules governing the liability of online intermediaries have been the same for 20 years. Online intermediaries are not liable for the information they transmit or store, provided they have no knowledge of the unlawful nature of that information. If they do, they must act promptly to make the information unavailable.
In essence, nothing is changing on this point. Indeed, the provisions on this are largely taken word for word from the old e-Commerce Directive.
What does change is the following. Under the old regulation, it was not wise for an online intermediary to remove or moderate information. After all, that could lead to knowledge of the unlawful nature of information, and thus liability. That gives the perverse incentive to just sit back and do nothing.
The new proposal provides that an online intermediary will not be liable merely for voluntarily taking activities to remove illegal content. This seems like a step forward: online intermediaries are given more leeway to do something about illegal content on their own, without being directly at risk.
The ability of platform to do something about illegal content itself poses dangers to the fundamental rights of Internet users. In particular, the right to freedom of expression may be at stake. Partly for this reason, hosting providers and online platforms must maintain a complaint handling system. There, a user should be able to file a complaint when, for example, a platform removes information posted by him, or blocks his access to information. Hosting providers and online platforms must handle complaints quickly, objectively and carefully.
The existing notice-and-takedown practice will be made legal for hosting providers in a notice-and-action requirement. They must give their users the ability to alert them to illegal content. That process will be covered with safeguards to prevent abuse.
Online platforms, a subcategory of hosting providers, will have to suspend users who post illegal content too often. The same goes for users who use the notice-and-action requirement too often without justification.
Not all online platforms must comply with these rules. There are exceptions for so-called micro and small enterprises. These are enterprises with fewer than 10 employees and a turnover of less than 2 million per year, respectively (micro-enterprise), or fewer than 50 people and a turnover of less than 10 million per year (small enterprise).
Tech giants have had more or less free rein in Europe for 20 years. This has led to the situation where parties such as Google, Facebook, Amazon and Apple are so big that there is too little actual competition in the markets where they operate. Tech giants can nip any competition in the bud thanks to competitive advantage. The data they use to collect it helps. That situation must end, and the Digital Markets Act regulates it.
Gatekeepers are the so-called core platform services: search engines, social networks, video sharing services, cloud computing services, and a few others. They are gatekeepers if they:
Have a significant impact on the internal market;
Being a "gateway" for companies to reach end users; and
Have achieved or will achieve an entrenched and sustainable position in their operations.
A complicated definition, involving the number of users (over 45 million) and annual revenue (over 6.5 billion). In any case, this will include Google, Facebook, Apple, Amazon and Microsoft, with the question still open as to whether this will then apply to all their services or whether the assessment should be done on a service-by-service basis.
A number of far-reaching obligations are imposed on gatekeepers. For example, in competition with their business users, they may not use data obtained through the use of their services by those business users. Think: Amazon is not allowed to use price information from providers on its platform in order to better sell its own products.
Nor may they prohibit their business users from offering their products or services elsewhere, or require business users to use their login systems for their services. After all, the latter method collects an awful lot of data on end users, which in turn creates an unfair competitive advantage.
The list of obligations goes far beyond this. The Commission will have enforcement powers, and may even eventually take "structural remedies. What the Commission means by this is not specified, but one might think of a mandatory sale of part of a tech giant. That would be an enormously far-reaching enforcement option, but not new (anymore). These concerns about the role of tech giants are also at play in America, and it seems that regulators want Facebook to sell off Whatsapp and Instagram.
The DSA and the DMA are far from their final versions. There will be endless lobbying to connect the right dots, or weaken commitments.
What is clear: Europe is not taking half-measures. All types of online service providers face new rules.
