More extensive obligations of intermediary service providers under the DSA

Intermediary service providers In Spain have been complying with the obligations and duties imposed on them by the Spanish Ecommerce Act, which implemented the Ecommerce Directive (Directive 2000/31/EC). Now, with the entry into force of the EU's Digital Services Act (DSA), their obligations and duties might be extended. The DSA, which was published on 27 October, aims to harmonise the existing legal regimes for the provision of intermediary services across the EU internal market.

Exemption of liability

The liability regime applicable to providers of intermediary services set out in the DSA would be essentially the same as the one established by the Spanish Ecommerce Act. Providers of intermediary services would not be responsible for the illicit information uploaded to their online interface by users, if they have no actual knowledge of the existence of such information and, in situations when they are aware of it, they act diligently to prevent access to it.

The DSA, in the pursuit of a safe online environment, allows providers to benefit from the exemption of liability even if they deploy active measures to detect, identify and block illegal content. To the extent that the DSA would be applicable without prejudice to EU copyright law, which lays down obligations – in practice – to detect illegal content in order to avoid liabilities. The DSA provision may be clarifying in advance that the adoption of active measures by providers would not automatically entail an active behavioural response from providers; and, aside from copyright considerations, they would not be liable for the information they transmit and/or store.

Specifically, online marketplaces are not able to rely on this liability regime and could be held liable under consumer protection laws in certain circumstances; in particular, if they enabled the content uploaded by traders in a way that could lead an average consumer to believe that the information was facilitated by the provider of the intermediation service itself (or by traders acting under its authority or control). For example, if the provider of the intermediation service does not disclose the identity of the trader to the consumer until after the transaction has been completed, the average consumer may have reasons to believe that they have been engaging with the provider of intermediary services and not with the trader.

Due diligence obligations

Under the Spanish Ecommerce Act, online platforms have not been obliged, in principle, to collect any information or documentation of their traders, nor to ensure the accuracy of any information provided by the traders. In this regard, online platforms will face a U-turn when the DSA becomes applicable, since it sets out know your business customer (KYBC) obligations (that is, traceability obligations) that should be observed. The online platform will need to collect essential information from its traders and ensure its completeness and accuracy through available means (for example, commercial or other type of registers, databases, VAT Information Exchange System, etc.).

In this sense, online platforms should randomly check using official, freely accessible and machine-readable online databases or online interfaces if the products or services offered by traders through them have been identified as illegal. Requiring platforms to conduct random checks on the illegality of products and services offered would represent a shift from the previously held position on platform neutrality, and it is yet to be seen how platforms' resources will comply with this requirement.

Further to these due diligence obligations, where online platforms have reasons to believe that any KYBC information provided by traders is inaccurate, incomplete or not up-to-date, they should request that traders remedy the situation. If a trader does not correct or complete the information, the relevant online marketplace should suspend the provision of its services to that trader. We understand that the failure to correct or complete information could potentially lead to the termination of contracts with offending  traders.

Very large online platforms and search engines

Online platforms or online search engines categorised  as "very large" (that is, those with average monthly number of users that correspond to 10% or more of the total number of consumers in the EU, currently set at 45 million people) would face more extensive obligations. By way of illustration, very large online platforms and very large online search engines are obliged to identify, analyse and assess any systemic risks resulting from the design, functioning and use of their service. Once risks have been identified, they would have to put in place measures to mitigate them (for example, adapting the design and features of the service, adapting content moderation processes and cooperating with trusted flaggers, among others). They are also required to comply with a number of additional obligations of transparency and cooperation with the authorities.

Implementation, fines and enforcement

The DSA sets out an obligation to Member States to ensure that the maximum amount that could be imposed as a fine for the failure to comply with the DSA is 6% of the service provider's annual revenue. The current maximum fines expected in the Spanish Ecommerce Act for very serious infringements would be €600,000.

The DSA sets out a vacatio legis period for its application, which, in general terms, will end on 17 February 2024. The DSA will be enforceable and legal rights and obligations exercised effectively from that date onwards. During this interim period, Spain may undertake the necessary legislative procedures to harmonise Spanish legislation with the DSA, in particular the Spanish Ecommerce Act.

Notwithstanding the foregoing, online platforms would have to submit to the European Commission before 17 February 2023 their total number of active end users in the EU. This will allow the Commission to categorise them as very large online platforms (or, if applicable, very large online search engines). Very large online platforms and search engines would have to comply with the specific provisions set out in the DSA for this type of intermediary services provider within four months of their being categorised by the Commission categorised as "very large".