Digital Services Act

Determine single points of contact, legal representatives, and compliance heads, communicate who they are and empower them. Also, work with your Board to establish DSA compliance duties and wider oversight structures including reporting frequency, air time to be provided to DSA compliance discussions and type and depth of Management Information (MI) and reporting to inform the Board and other governance fora on DSA risk and compliance matters.

This includes updating terms and conditions, and communicating changes. For example, information on any policies, procedures, measures and tools used for the purpose of content moderation, including algorithmic decision-making and human review. Firms should also take steps to ensure recommender system transparency and provide recommender system optionality.

Implement measures to prevent the manipulation of the recipients to make free and informed decisions. Firms should also implement transparent advertisement methods and take steps to protect minors and implement bans on targeted adverts to children and those based on special characteristics of users. In addition, online platforms should implement Know Your Business Clients (KYBC) controls and enable compliance by design, in particular in the case of online market places.

Develop notification and action mechanisms to allow individuals or entities to notify them of information that may be illegal. Also, establish processes to notify suspicions of criminal offences to relevant law enforcement or judicial authorities, implement trusted flaggers technical and organisational measures, and implement measures and protection against misuse, including suspension of services.

Implement an internal complaints-handling system and related processes following decisions to remove, disable, restrict access of information; suspend or terminate the provision of the service, suspend or terminate the recipients’ account; and suspend, terminate or otherwise restrict the ability to monetise information provided by the recipients. Online platforms must also respond to complaints logged effectively and efficiently; and inform users of out-of-court dispute settlement mechanisms.

Very Large Online Platforms and Search Engines (VLOP’s/ VLOSE’s) must establish procedures to identify, analyse and assess any systemic risks stemming from the design or functioning of their service and its related systems, including algorithmic systems, or from the use made of their services. This includes performing systemic risk assessments based on probability and severity; and implementing controls to mitigate systemic risks. To some extent, it is likely non-VLOPs/VLOSEs will also need to put similar processes in place

Very Large Online Platforms and Search Engines (VLOPs/ VLOSE’s) should also establish an independent Compliance Function with direct reporting line to the Board. This means that a compliance framework and operating model will likely be required to perform compliance oversight activities and processes. Consideration should be given to establishing a central compliance team as opposed to operating in silos, particularly in the case of global firms.

A crisis shall be deemed to have occurred where extraordinary circumstances lead to a serious threat to public security or public health in the EU or in significant parts of it. Online platforms should identify, assess and implement measures to prevent or eliminate serious threats; develop crisis protocols for addressing crisis situations, and report to the Commission (at regularly intervals) the implementation and qualitative and quantitative impact of the measures taken to mitigate serious threats.

Online platforms should develop and publish annual content moderation transparency reports. For example: publish reports on any content moderation activity performed, e.g. number of notices submitted, number of complaints received. Online platforms should also establish processes that allow them to respond to data access requests from the Commission or Digital Services Coordinators.