DSA Compliance Deadlines Loom as Data Act Awaited

The European Union’s busy 2023 in digital regulation includes most major deadlines for enforcement of the Digital Services Act (DSA), as well as efforts to create new legislation that will also contribute to the changes in the legal regimes that underpin how digital markets will operate in the EU.  

The DSA’s deadline for online platforms and search engines to publicize their monthly users was February 17, 2023. That exercise must be repeated “at least every six months thereafter” under Article 24(2) – meaning that an updated publication will be due on August 17, 2023. The key number to look for in these publications is 45 million monthly recipients of the service. This serves as a threshold for the designation of “very large online platforms” and “very large online search engines”, which comes with additional obligations over and above the requirements the DSA places on all “intermediary services” and “online platforms”1. Full compliance by “very large” services is required four months from designation. Thierry Breton, EU Industry Commissioner, announced that “very large” services would have to comply with the DSA by September 1, 2023, which means that the Commission designation should happen by May 1, 2023. The DSA obligations will apply to other service providers as of February 17, 2024. 

The European Union’s busy 2023 in digital regulation includes most major deadlines for enforcement of the Digital Services Act (DSA), as well as efforts to create new legislation that will also contribute to the changes in the legal regimes that underpin how digital markets will operate in the EU.  

The DSA’s deadline for online platforms and search engines to publicize their monthly users was February 17, 2023. That exercise must be repeated “at least every six months thereafter” under Article 24(2) – meaning that an updated publication will be due on August 17, 2023. The key number to look for in these publications is 45 million monthly recipients of the service. This serves as a threshold for the designation of “very large online platforms” and “very large online search engines”, which comes with additional obligations over and above the requirements the DSA places on all “intermediary services” and “online platforms”1. Full compliance by “very large” services is required four months from designation. Thierry Breton, EU Industry Commissioner, announced that “very large” services would have to comply with the DSA by September 1, 2023, which means that the Commission designation should happen by May 1, 2023. The DSA obligations will apply to other service providers as of February 17, 2024. 

Online Providers Within the DSA's Scope, Intermediary services offering network infrastructure: Internet access providers, domain name registrars, including also:
Online Providers Within the DSA's Scope, Hosting services such as cloud and webhosting services, including also:
Online platforms bringing together sellers and  consumers such as online marketplaces, app stores, collaborative economy platforms and social media platforms.
Very large online platforms pose particular risks in  the dissemination of illegal content and societal harms. Specific rules are foreseen for platforms reaching more than 10% of 450 million consumers in Europe.
Online Providers Within the DSA's Scope, Intermediary services offering network infrastructure: Internet access providers, domain name registrars, including also:
Online Providers Within the DSA's Scope, Hosting services such as cloud and webhosting services, including also:
Online platforms bringing together sellers and  consumers such as online marketplaces, app stores, collaborative economy platforms and social media platforms.
Very large online platforms pose particular risks in  the dissemination of illegal content and societal harms. Specific rules are foreseen for platforms reaching more than 10% of 450 million consumers in Europe.

The European Union’s busy 2023 in digital regulation includes most major deadlines for enforcement of the Digital Services Act (DSA), as well as efforts to create new legislation that will also contribute to the changes in the legal regimes that underpin how digital markets will operate in the EU.  

The DSA’s deadline for online platforms and search engines to publicize their monthly users was February 17, 2023. That exercise must be repeated “at least every six months thereafter” under Article 24(2) – meaning that an updated publication will be due on August 17, 2023. The key number to look for in these publications is 45 million monthly recipients of the service. This serves as a threshold for the designation of “very large online platforms” and “very large online search engines”, which comes with additional obligations over and above the requirements the DSA places on all “intermediary services” and “online platforms”1. Full compliance by “very large” services is required four months from designation. Thierry Breton, EU Industry Commissioner, announced that “very large” services would have to comply with the DSA by September 1, 2023, which means that the Commission designation should happen by May 1, 2023. The DSA obligations will apply to other service providers as of February 17, 2024. 

Online Providers Within the DSA's Scope
Online Providers Within the DSA's Scope
Online Providers Within the DSA's Scope
Online Providers Within the DSA's Scope
Online Providers Within the DSA's Scope
Online Providers Within the DSA's Scope
Online Providers Within the DSA's Scope
Online Providers Within the DSA's Scope
Online Providers Within the DSA's Scope
Online Providers Within the DSA's Scope

To guide the implementation of the DSA, on December 22, 2022, the Commission published its first draft Delegated Regulation. With another interim report due in March 2023, the upcoming year should see further refinements to what the recommended rules may be. We also expect more details on their substantive content and scope. The Delegated Regulation specifies the criteria that will be used to calculate the annual supervisory fees that providers of services designated as “very large” will have to pay under Article 43 of the DSA. It contains the detailed methodology and procedure that the Commission will apply to estimate the costs and calculate the fees that each service provider will have to pay.  

In addition, on February 1, 2023, the Commission published guidance on the obligation to publish information on the average monthly active recipients of the relevant services in the European Union. This is particularly relevant for the designation of “very large” services. This guidance takes the form of a Q&A and addresses recurring questions that the Commission has received from providers of intermediary services. It may be reviewed in the months to come to reflect practical experience.  

Separately, the Commission is now consulting on its monitoring and investigatory procedures as it looks past designation and towards substantive compliance.

DSA implementation will be something of a proving ground. As the first major digital regulation to come into force, there will be global scrutiny from regulators, companies, and end-users on how smoothly the legislation can be applied in practice.  

DSA timeline: December 22, 2022 – Commission publishes first draft Delegated Regulation January 19, 2023 – Public consultation on Delegated Regulation closed February 17, 2023 – Deadline for online platforms and search engines to publicize their monthly users May 1, 2023 – Commission designation of ‘very large’ platforms to take place by this date February 17, 2024 – DSA obligations apply to other service providers
DSA timeline: December 22, 2022 – Commission publishes first draft Delegated Regulation January 19, 2023 – Public consultation on Delegated Regulation closed February 17, 2023 – Deadline for online platforms and search engines to publicize their monthly users May 1, 2023 – Commission designation of ‘very large’ platforms to take place by this date February 17, 2024 – DSA obligations apply to other service providers

To guide the implementation of the DSA, on December 22, 2022, the Commission published its first draft Delegated Regulation. With another interim report due in March 2023, the upcoming year should see further refinements to what the recommended rules may be. We also expect more details on their substantive content and scope. The Delegated Regulation specifies the criteria that will be used to calculate the annual supervisory fees that providers of services designated as “very large” will have to pay under Article 43 of the DSA. It contains the detailed methodology and procedure that the Commission will apply to estimate the costs and calculate the fees that each service provider will have to pay.  

In addition, on February 1, 2023, the Commission published guidance on the obligation to publish information on the average monthly active recipients of the relevant services in the European Union. This is particularly relevant for the designation of “very large” services. This guidance takes the form of a Q&A and addresses recurring questions that the Commission has received from providers of intermediary services. It may be reviewed in the months to come to reflect practical experience.  

Separately, the Commission is now consulting on its monitoring and investigatory procedures as it looks past designation and towards substantive compliance.

DSA implementation will be something of a proving ground. As the first major digital regulation to come into force, there will be global scrutiny from regulators, companies, and end-users on how smoothly the legislation can be applied in practice.  

“We’ve seen a spate of new legislation in Europe, with the DMA, DSA and Foreign Subsides Regulation all being adopted in 2022. Interesting times are ahead as to how the enforcement of these new tools will coexist with traditional competition enforcement.” Isabel Rooms, Partner - Looking forward to 2023 and back at 2022 - Antitrust Review Podcast

The Data Act  

The Data Act is someway behind the DMA and DSA, since it is still in the legislative process. 2023’s legislative agenda includes a proposal to progress the Act, and the European Parliament finalized its proposed text on March 14. Among other things would oblige manufacturers of connected devices to share data generated by those devices with the user and with third parties at the user’s request. The obligations on device manufacturers may have implications for antitrust assessments, particularly in the context of so-called “aftermarkets” where the law may facilitate access to data by third-party service providers, although the ultimate requirements are not yet clear. The legislative process, which has yet to reach the trilogue stage, may not be completed before the end of the year. 

Separately, the Commission is said to be preparing a draft legislation on opening up data generated from connected cars. The draft rules reflect a concern that the Data Act will not address some specific use cases that are relevant to automotive data. A draft regulation is expected in Q2 of this year. 

2023’s legislative agenda includes a proposal to progress the Act, which among other things would oblige manufacturers of connected devices to share data generated by those devices with the user and with third parties at the user’s request.

The Data Act  

The Data Act is someway behind the DMA and DSA, since it is still in the legislative process. 2023’s legislative agenda includes a proposal to progress the Act, and the European Parliament finalized its proposed text on March 14. Among other things would oblige manufacturers of connected devices to share data generated by those devices with the user and with third parties at the user’s request. The obligations on device manufacturers may have implications for antitrust assessments, particularly in the context of so-called “aftermarkets” where the law may facilitate access to data by third-party service providers, although the ultimate requirements are not yet clear. The legislative process, which has yet to reach the trilogue stage, may not be completed before the end of the year. 

Separately, the Commission is said to be preparing a draft legislation on opening up data generated from connected cars. The draft rules reflect a concern that the Data Act will not address some specific use cases that are relevant to automotive data. A draft regulation is expected in Q2 of this year. 

“It will be interesting to see how the [European] Commission takes on its novel role as an enforcer of a sector-specific regulation, and how it coordinates with national authorities and manages complementary national legislation.” Patrick Bock, Partner