The EU’s New Digital Services Act — What Does it Mean for Global Privacy?

Posted on May 25, 2022 by Glyn Moody

Three main bodies of the EU — the European Commission, European Council, and European Parliament — have reached a “political agreement” on the Digital Services Act (DSA).

The new law mainly deals with regulating illegal and harmful content online, which will have wide-reaching effects for online users around the world. While the main points of the act have been agreed, it’s not yet finalized. 

As it stands, the act will have a significant impact on global privacy, whether the finer details have been agreed on or not.

A Movement Towards Greater Online Privacy

When the legislation was first announced in 2020, it appeared the act would give internet users greater control over their online privacy. In particular, one of the greatest threats to online privacy — micro-targeted advertising — would be regulated or even banned under the new law. 

Could the DSA put an end to targeted advertising?

As is often the case, however, the initial high hopes have not been fully realized. The final text bans certain types of ads on online platforms, but only when they target children or rely on  certain categories of personal data to target users, including ethnicity, political views, and sexual orientation. 

The Center for Democracy & Technology highlighted that other privacy-friendly movements were dropped during negotiations. This includes the protection of end-to-end encrypted services and the right to use services anonymously. 

On the plus side, the act does include a new requirement for transparency, notably for micro-targeted ads. Under the legislation, websites should make information about their advertisements publicly available to help with the identification of unnecessary, illegal, or manipulative advertising. 

This means that authorized individuals can audit advertisements to ensure they don’t have a negative impact on the public, for example, on their health, security, or equality. 

In particular, online platforms should ensure that they publish information about advertisers, the delivery of advertisements, and the content they contain. 

An End to General Online Monitoring

Another welcome feature of the DSA is that general monitoring by online services is forbidden, in order to further protect personal data and online privacy. 

In particular, the aim is to reduce general monitoring that could limit users’ freedom of expression and access to information. 

General online monitoring could soon be a forbidden act.

The DSA is also part of various EU legislations designed to bring global digital giants under control. One such legislation is the e Digital Markets Act (DMA), which prevents marketing giants such as Google and Apple from using non-public data, in an effort to tackle companies that abuse their marketing power.   

Another new EU law with major implications for privacy and surveillance is the Artificial Intelligence (AI) Act, which regulates the use of AI systems that pose a threat to public safety and rights. For example, systems that manipulate human behavior with complete disregard of free will.

The DMA and the AI Act are still grinding their way through the EU legislative process. But, as the (comparatively) rapid passage of the DSA shows, the EU can push through new laws relatively quickly if it wants to — especially if it has a strong incentive to do so.

Regaining Control — Is It Too Good to Be True?

One of the major motivations for the DSA is the considerable political and public pressure to limit the power of giant US corporations like Google and Facebook

In part, that may just be crude anti-Americanism, but many believe  these companies are simply too big and exert too much unbridled power over people’s everyday lives. 

The other reason flows from the fact that people and governments around the world feel broadly the same, but have yet to frame laws to address the problem. The EU is keen to be the first to bring in major legislation to create a benchmark that others might choose to work to, not least because it would be the easy option for legislators struggling to find good approaches.

In particular, the EU is greatly encouraged by the way the General Data Protection Regulation (GDPR) has become the global standard for privacy protection — despite the undoubted flaws with this law, and the fact that it still isn’t being properly enforced throughout the EU. 

Nonetheless, the GDPR possesses one huge advantage over other approaches to handling privacy in the digital age — it exists and it’s up and running. It provides a handy template for others to use as the basis for their own privacy laws. Bringing in the DSA, DMA and AI laws before the US and other countries catch up means the EU has once more a chance to set the rules globally.

The Elon Musk Effect

We may be about to witness an early test-case of what happens when a US internet company and its culture come face to face with  new EU laws. 

It’s no secret that Elon Musk wants to acquire Twitter. If the deal goes through, it’s expected he’ll use the platform to demonstrate his commitment to free speech, which he describes as the “bedrock of a functioning democracy“. 

In response, Thierry Breton — the EU’s commissioner for the internal market — told the Financial Times (paywall) that Musk’s new Twitter style will be subject to the DSA’s rules on moderating illegal and harmful content online. In his statement, he mentioned how Elon will be expected to comply with the rules, highlighting that “it’s not your rules which will apply here”.

A few days later, Breton published a bizarre video of himself and Musk on his Twitter — supposedly sharing “a quick message” on platform regulation, but not really saying much at all on the matter. Musk replied on Twitter, saying: “Great meeting! We are very much on the same page.” 

Given what we know about the position of the EU and Musk, it seems unlikely that they’re singing from the same hymn sheet. If the Twitter deal goes through, it should be interesting to find out over the coming months and years whether Musk will comply with the legislation that governs social media platforms.

But the real question is, will the DSA help us regain control over our personal data and digital privacy? Who knows. While it seemed promising at first, decision-makers appear to have dropped significant laws that would protect digital privacy. Still, we have hope.