Under the Digital Services Act (DSA) that regulates online services content and more, 17 February 2023 marks the first deadline for “online platforms”; after that, “very large online platforms” (VLOPs) have four months after designation as such by the European Commission to comply fully; and 17 February 2024 is the deadline for all hosting, caching and mere conduit services offered to EU customers, which is not far away at all in the scheme of things. Effective 17 November 2022, the DSA carries GDPR-beating fines of up to 6% turnover.
Below are some key practical action points in light of these deadlines.
Near future, before 17 February 2023
If you offer any online on-demand service to EU users (whether consumer, business, etc), consider whether it is an “online platform” within the DSA that hosts and disseminates user-provided information publicly:
Online platforms include social networks and online marketplaces. IaaS/PaaS cloud and webhosting services are generally not online platforms, but are “hosting” services (see later). SaaS services could be online platforms, depending on the nature of the service.
Consider the applicability of exemptions for minor/ancillary public dissemination (e.g. comments sections in online news sites). Also consider the position regarding public groups/open channels.
Consider what approach to take if service users individually can choose whether to make some of their content private, public or shared only with a limited group.
Consider whether to argue that it is not an “online platform” because only registered users who have been granted access following a human decision or selection can view content, so there is no public dissemination (but bear in mind that regulators/courts may not accept this point if made by big tech platforms, given the DSA’s purposes).
If it is an online platform, decide whether to:
update systems, policies/processes ASAP to enable you to calculate, on an ongoing basis, the number of average monthly EU…..