Introduction: The DSA’s regulatory mandates

The DSA (see here and here for our previous coverage on the DSA) contains concrete regulatory mandates addressed to member states. These mandates concern in particular the cooperation of national authorities, sanctions, and the enforcement of the DSA, which shall be regulated by each member state individually, pursuant to the DSA’s admittedly rather (broad) specifications. In addition, the DSA requires a revision of national laws to fit into the DSA’s horizontal regulation scheme. To meet the DSA’s call for implementation and regulation the German government has published the Draft DDG which is due to be finalised towards the end of 2023.

The DDG will be particularly relevant for digital service providers based in Germany, which do not qualify as VLOPs or VLOSEs, hence having less than 45 million of monthly active users. This is because enforcement of the DSA against these providers lies within the powers of Germany or rather its designated authorities (and not with the European Commission as for VLOPs and VLOSEs). According to estimates by the Federal Networking Agency and the Federal Statistical Office a total of 4,000 Germany-based intermediaries are expected to fall under scrutiny of the German DSC, including around 200 online platforms (according to reports this includes, among others, the online music platform Soundcloud, cf. link).

Background: The DSA’s objective of harmonizing the digital realm

On 16 November 2022, the DSA entered into force. The Regulation will be applicable as of 17 February 2024 for all online intermediaries and establishes a horizontal legal framework for digital services. As noted, the 17 VLOPs and 2 VLOSEs designated by the Commission are bound to abide by the full set of the DSA’s obligations since 25 August 2023.

The objective of the DSA is to establish harmonized horizontal rules for a safe, predictable and trustworthy online environment within the scope of the EU’s Digital Single Market Strategy. It also aims to establish a robust and permanent supervisory structure to ensure effective oversight over providers and in particular online platforms in Europe. As a newly established supervisory authority, a Digital Services Coordinator will be appointed in each member state.

The DSA regulates in an unprecedented level of detail the relationship between digital service providers and their users. The regulation provides for graduated obligations with the most extensive obligations affecting VLOPs and VLOSEs. The DSA regime foresees that hosting providers and providers of online platforms must, inter alia, have a notice and action mechanism for illegal content in place. Where such mechanisms are abused or other illegal activities on the platform occur, platforms are obliged to take measures against such conduct. Notices submitted by “trusted flaggers” (to be designated by the member state DSC) must be given priority. Online marketplaces will have to pre-vet merchants offering products or services on their platforms. These are only illustrative examples of the myriad of newly introduced obligations aiming to promote a safe digital environment in the EU.

Key aspects of the Draft DDG

On balance, the Draft DDG regulates the digital space progressively but by no means – and for an implementing law not surprisingly – builds on the pioneering effect of its “predecessor” NetzDG. The latter becomes obsolete as per the DDG. The DDG largely stays within the lines of the DSA’s regulatory mandates and fits well into the horizontal DSA regime, thus serving its objective of a harmonized digital space in the EU.

NetzDG and TMG replaced: What is due to change?

Following the EU legislator’s call for harmonization and its objective to create a comprehensive horizontal framework for regulating digital services, the German legislator scrutinized its current national digital service law, namely its NetzDG and TMG, for potential contradictions with the DSA. While both laws will cease to be in effect, selected provisions of the German TMG have found their way into the Draft DDG. For instance, the TMG’s general information obligation as well as specific obligations for commercial communication.

The adoption of the national TMG provisions may initially appear contradictory considering the harmonizing effect the DSA lays claim on. These regulations are however (at least partly) implementations of the E-Commerce Directive and other EU regulations, namely the Audiovisual Media Services Directive, the Data Protection Directive and ePrivacy Directive. As the DSA itself simply states that it is “without prejudice” to these other regulations, the German legislator moved these TMG provisions to the new DDG.

Firstly, due to the NetzDG being completely replaced by the DSA, some essential points in Germany are due to change. One of them being the definition of illegal content which is considerably broader in the DSA and includes illegal goods, services, content and activities online (as opposed to only specific content sanctioned in the German Criminal Code in the NetzDG).

Secondly, the DSA and accordingly the DDG does not provide for fixed turnaround times, inter alia, for the processing of notices, for which it foresees a rather broad premise of “ timely” and otherwise “diligent, non-arbitrary and objective” processing. The NetzDG on the contrary mandates providers to process notices within 24 hours upon receipt and remove illegal content within 7 days. Yet, these fixed deadlines will likely have indicative value when interpreting the explicable DSA term of “timely” in Germany.

Thirdly, the DDG’s fining regime seemingly has a different underlying understanding than the NetzDG’s. Whereas the NetzDG only fines systematic infringements, i.e., where structural organisational obligations are repeatedly violated, the DDG provides also for fines if providers fail to take the “right” action in an individual case (see in more detail below). Also the amount of potential fines is higher in the DDG: As envisaged by the DSA, fines can go up to 6% of the worldwide annual turnover of the provider concerned in the previous business year.

Designation of the DSC and other competent authorities

As widely anticipated after an initial to and fro, the DDG designates the Federal Network Agency (Bundesnetzagentur) as Germany’s DSC responsible for the supervision of providers and the enforcement of the DSA (Sec. 13 DDG). The DDG further regulates in detail its establishment, its resources, its required independence and the general management of the DSC as well as its cooperation with various national authorities and the establishment of an advisory board (Sec. 14 DDG et seq.).

In addition, the DDG assigns powers to authorities for the enforcement of particular articles of the DSA. The Federal Agency for the Protection of Children and Young Persons in the Media (Bundeszentrale für Kinder- und Jugendmedienschutz) is intended to become the competent authority for the enforcement of minors protections as enshrined in Articles 14(3) and 28(1) DSA. The Federal Commissioner for Data Protection and Freedom of Information (Bundesbeauftragte für den Datenschutz und die Informationsfreiheit) shall become the competent authority for the enforcement of Articles 26(3) and 28(2) and (3) DSA, i.e. advertising profiling. According to Sec. 13 DDG information pursuant to Article 18(1) DSA (Notification of suspicions of criminal offenses) will be received and processed by the Federal Criminal Police Office (Bundeskriminalamt).

It is noteworthy that the Draft DDG – in a side note – provides for the possibility of assigning further authorities with responsibilities and tasks in relation to the DSA. By leaving this point open, the Federal Government might have hoped to receive input from experts on the ideal distribution of responsibilities and tasks between authorities in the commenting phase. The majority of the comments received on this point clearly advocate against the designation of powers to additional competent authorities and a further sprawling and fragmentation of responsibilities and tasks between authorities. Instead some civil society associations even call for the establishment of an independent German “Digital Services Agency”.

Fines

The DDG further lays out the fine regime for violations of the DSA. It states that any person who intentionally or negligently violates one of the DSA’s provisions shall be fined, Sec. 25(3) DDG.

The drafting of the fining provisions suggests that any individual case of a violation can lead to a fine which is new to German content moderation law. Previously, a digital service provider per the NetzDG was only responsible for structural deficiencies in its systems and procedures.

The DDG lists each individual DSA obligation separately in its fining catalogue, it – however leaves two central provisions of the DSA undefined: the handling of notice-and-action notices – and notifications of a criminal offense. Here, too, the legislator has deliberately left this open in order to get expert opinions in the commenting phase. Whether individual incorrect moderation decisions, which according to Article 16(6) sentence 1 DSA must be made in a “timely, diligent, non-arbitrary and objective manner”, should be followed by a fine is highly controversial. The public discourse remains to be seen with interest. The same applies to the failure to notify suspicions of criminal offenses. Even before the publication of the Draft DDG, experts were critical of introducing a fining system foreseeing sanctions for individual cases. This was justified, inter alia, on the basis of recital 109 sentence 4 DSA, according to which it is not necessary to decide on the illegality of specific items of content. It is feared that the resulting liability risk could lead to excessive caution on the part of online platforms and create disincentives for overblocking.

The possible amount of the fine differs depending on which provision of the DSA is violated. The DDG fining regime divides the provisions of the DSA into two categories in Sec. 25(5) and, in interaction with Sec. 25(6), is guided by the maximum amounts set forth in Article 52(3) DSA. The first category covers all structural organisational obligations, in particular the establishment of a notice and action mechanism, and all DSA obligations not falling under the second category. The second category covers fines for the supply of incorrect, incomplete or misleading information, failure to reply or rectify incorrect, incomplete or misleading information and failure to submit to an inspection. The maximum possible fine for the first category is EUR 300,000 (for legal persons with an annual turnover of more than 5 million EUR even up to 6% of the worldwide annual turnover) and for the second category EUR 100,000 (for legal persons with an annual turnover of more than 10 million EUR up to 1% of the worldwide annual turnover).

Out-of-court dispute settlement bodies

Article 21 DSA provides for regulations on out-of-court dispute settlement bodies and mandates the member states to certify those bodies established in their country. The DDG Draft does not sufficiently implement these requirements; it unduly narrows down its area of application.

In fact, the DDG provides for a regulation of dispute settlement bodies to be inserted into Sec 14 et seq. of the Act on the Copyright Liability of Online Content Sharing Service Providers (in German: Urheberrechts-Diensteanbieter-Gesetz, hereinafter UrhDaG) where similar regulations already exist. Including these provisions into the UrhDaG would limit the availability of out-of-court dispute settlement bodies to cases of blocking of copyrighted content. For the majority of cases under the DSA, this would effectively mean that they could not be settled before an out-of-court dispute settlement body, although the DSA foresees the possibility of seizing these bodies in all conceivable cases involving illegal content. This clearly contradicts the intended regulation in Article 21 DSA and hence, must be amended in the legislative process.

This apparent mistake presumably occurred as the legislator was immensely time-rushed in the drafting process. In the very first Draft DDG (which was only unofficially leaked in expert circles earlier this year) the legislator provided for the establishment of a taxpayer-funded national out-of-court settlement body set up within the DSC. This proposal was met with harsh criticism by experts contesting in particular the stipulation that the body would be funded by taxpayer money.

Interplay and potential frictions with the DSA

German legislators claim that the Draft DDG is compatible with EU Law and international treaties.

On the whole, the implementation of the DSA into German law by the DDG is to be commended and – apart from the current draft regulation on out-of-court dispute settlement bodies – is largely in accordance with the DSA. However, the DDG deliberately left some questions open. These are, among others, the question of fines relating to the processing of notices and the notifications of suspicions of criminal offences and the designation of further competent authorities according to Article 49(1) DSA. Otherwise, there are no apparent conflicts with the DSA. The draft DDG fits well into the legal framework of the DSA and implements the regulatory mandates to a large extent.

Next steps: German legislator under time pressure

Following the publication of the Draft DDG, the comment period for (federal) German states, associations, organizations and (federal) institutions has now closed. Despite the unusually short commenting phase which also took place during the parliamentary recess, over a dozen of civil society organizations as well as some state media authorities have submitted their comments. The DGG is currently planned to be adopted at the end of November or early December.

Once the revised Draft DDG has been approved by the Federal Council (Bundesrat) the Draft DDG will be discussed and most probably adopted with further amendments and lastly passed by the German parliament (Bundestag). As the German DSC needs to be established and well set-up by 17 February 2024, the legislator is under time pressure.

Authored by Marlen Mittelstein and Katharina Schwalke.

Hogan Lovells’ DSA Taskforce

Our multi-jurisdictional DSA Taskforce closely follows all developments of the DSA implementation on national and EU level. We will provide further regular Engage updates covering the key developments.