The European Union passed Regulation (EU) 2022/1925, better known as the Digital Markets Act (or "DMA"), and Regulation (EU) 2022/2065, better known as the Digital Services Act (or "DSA"), in October 2022. These two regulations are part of the "Digital Services Package," which is aimed at creating a safer digital space in which all users are protected and to establish a level playing field to foster innovation, growth, and competitiveness in the EU market and globally.
Who Does It Impact?
The DMA applies to core platform services provided or offered by "Gatekeepers," such as search engines, social networking, cloud services, etc. The European Commission has designated seven companies as Gatekeepers, including Apple, Amazon, Alphabet (parent company of Google and Android), Meta (parent company of Facebook, Instagram and WhatsApp), Booking.com, ByteDance (parent company of TikTok) and Microsoft.
The DSA applies to all digital intermediary services, especially very large online platforms (VLOPs) and very large online search engines (VLOSEs) with 45 million or more monthly active users in the EU. The European Commission has designated 17 organizations as VLOPs and two organizations as VLOSEs. Following their designation by the European Commission, organizations are required to comply with the obligations under either the DMA and/or DSA within four months, as applicable.
Any organization that is designated as either a Gatekeeper under the DMA or a VLOP or VLOSE under the DSA is required to comply with the obligations under each Act.
Key Objectives of the DMA and DSA
Digital Markets Act
Under the DMA, gatekeepers will need to follow a set of rules that prevent them from engaging in unfair practices on their platforms, promoting a fairer and more competitive digital environment. Gatekeepers must:
- eliminate unfair or anti-competitive practices;
- obtain user consent before collecting and processing personal data for targeted advertising purposes;
- provide access to data collected or generated by their platforms;
- ensure compatibility with other platforms and businesses by allowing users to easily subscribe or unsubscribe, and access and use content, features or other functionalities through their core platform services using the software application of a third-party business user; and
- prevent favouring their own functionalities or services, or those of specific partners.
Digital Services Act
Under the DSA, VLOPs and VLOSEs must comply with a set of rules aimed at empowering and protecting users online, including minors, by requiring organizations to assess and mitigate their systemic risks and to provide robust content moderation tools. Accordingly, VLOPs and VLOSEs must:
- moderate content;
- implement and maintain mechanisms for handling user complaints;
- ensure algorithmic transparency;
- cooperate with authorities; and
- implement and maintain measures to prevent the spreading of illegal content.
How the DMA and DSA Fit Within the Canadian Regulatory Landscape
Canadian businesses that operate online platforms in the EU may be designated as Gatekeepers, VLOPs or VLOSEs, making them subject to the DMA and DSA. As a result, Canadian platform, search engine and digital intermediaries should be familiar with the Digital Services Package and assess whether they may be subject to designation under either Act.
Canadian businesses are already subject to privacy laws within Canada that mandate transparency, individual accessibility and cooperation with authorities.
Why the DMA and DSA Matter to Canadian Businesses
It is important for businesses that operate platforms in the EU to stay current with the DMA and DSA. The DMA authorizes the European Commission to impose fines of up to 10% of an organization's annual worldwide turnover, or up to 20% in case of repeated infringements. In addition to fines, the Commission may impose behavioral or structural remedies if a gatekeeper systematically fails to comply with the DMA. These remedies can include divestiture of business units or a ban on acquisitions related to noncompliant practices.
Similarly, the DSA authorizes the European Commission to impose fines of up to 6% of the organization's annual worldwide turnover as well as periodic penalty payments of up to 5% of a company's average daily worldwide turnover for continued non-compliance.
These fines under the DMA and DSA can have far-reaching and impactful consequences. Any organization operating a large online platform should consider whether their current operations align with the requirements under these Acts.
How to Prepare
To comply with the DMA and DSA, Canadian businesses with operations in the EU should undertake a review of their current practices to identify adequate measures already in place as well as possible shortfalls. Businesses should assess their consent management procedures, ensuring notices are transparent, accurate and up to date, and content is monitored and moderated. Ensuring business practices related to consent, user control, transparency, and content moderation align with global requirements can strengthen and maintain operational resilience both in Canada and abroad.
The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.
