Illegal content online – what applies under the DSA?

• The DSA applies to intermediary services offered to recipients of the service that have their place of establishment or are located within the EU – regardless of where the provider is established. For a provider outside the EU, the service must have a substantial connection to the Union. [1]

• The DSA does not normally determine whether particular content is illegal. This must be assessed under the Union or national law applicable to the content in question.

• A hosting service provider is, as a starting point, not liable for information stored at the request of a user, provided that the provider lacks actual knowledge or awareness of illegal activity or illegal content within the meaning of Article 6 of the DSA. Once the provider obtains such knowledge or awareness, it must act expeditiously to remove the content or to disable access to the illegal content in order to retain the exemption from liability.

• A notice should, among other things, identify the content precisely and include a sufficiently substantiated explanation of why it is illegal. In practice, the legal basis should be stated, together with an explanation of why it applies to the content in question.

• A sufficiently precise and substantiated notice can give the provider actual knowledge or awareness of the illegal content within the meaning of Article 6 of the DSA. The provider must then act expeditiously to remove or to disable access to the illegal content – otherwise the exemption from liability may be lost. Whether the provider is subsequently actually liable is determined under the substantive law applicable to the illegal content.

• If a provider fails to comply with its obligations under the DSA, a recipient of the service may lodge a complaint with the Digital Services Coordinator. In Sweden, the Swedish Post and Telecom Authority (PTS) is the coordinator. For certain online platforms, internal complaint-handling and out-of-court dispute settlement are also available.

• The DSA does not, however, in itself give an individual the right to compel a provider to remove particular content. A binding order to act against illegal content must be based on other applicable Union or national law. The DSA regulates, among other things, how such orders are to be formulated and handled.

• In the case of, for example, copyright infringement, there are special options for seeking an injunction subject to a penalty fine from the Patent and Market Court against a service provider whose services are used for the infringement.

• At the end of the article, you will find a checklist of the key questions to go through before submitting a notice.

[1] A substantial connection to the Union may arise, among other things, from the provider being established in the Union or, where the provider has no establishment there, from the provider having a significant number of recipients of the service in one or more Member States, or from directing its activities towards one or more Member States. Factors such as language, currency, the ability to order goods or services, and local advertising may be taken into account in this assessment. Mere technical accessibility of a website from the EU is not sufficient.

The DSA applies to providers of intermediary services. The regulation distinguishes between three categories: mere conduit services, caching services and hosting services.

Hosting services are central when it comes to content takedowns. A hosting service is a service that stores information provided by, and at the request of, a user. Examples include cloud services, web hosting, advertising services, and services that enable the exchange of information and content online.

Online platforms are a special category of hosting services. They store information provided by users and, with certain exceptions, disseminate that information to the public at the user's request. Social networks and digital marketplaces are typical examples.

The regulation does not only apply to providers established in the EU. It also covers providers outside the EU that offer services in the Union, provided there is a substantial connection to the Union. Such a connection may follow from, for example, a significant number of recipients of the service in one or more Member States, or from the targeting of activities towards one or more Member States, taking into account factors such as language, currency, the possibility of ordering products or services, or local advertising.

The DSA defines illegal content broadly: any information that is not in compliance with Union law or the law of a Member State that is in compliance with Union law. This can include, for example, the unauthorised sale of copyright-protected material, trademark infringement, the sale of counterfeit products, or misleading marketing.

It is not, however, sufficient for content to be negative, incorrect or commercially harmful. The content must be illegal under a specific legal rule.

The DSA does not require a court to have first established that the content is illegal. It is the provider that independently assesses, based on the notice received, whether the reported content is illegal. If a provider requires a court decision as a precondition for acting, that goes beyond what the DSA prescribes. A well-substantiated notice – one that clearly states which legal rule is relied on and why the content infringes it – gives the provider a sufficient basis to make that assessment without a prior legal review.

A notice under the DSA should not be drafted as a general complaint. It should be specific, clear and sufficiently substantiated.

A notice must contain four key elements:

• the content concerned and where it is located, for example through a URL;

• why the content is illegal and which legal basis is relied on;

• the action requested; and

• the contact details of the notifying party together with a statement confirming its bona fide belief that the information and allegations contained in the notice are accurate and complete.

The DSA therefore does not expressly require the notifying party to cite a specific provision of law. In practice, however, it is often appropriate to identify the legal basis that makes the content illegal and to explain why it applies. This assists the provider's assessment and can be decisive for whether the notice gives rise to the knowledge referred to in Article 6 of the DSA. It is also advisable to clearly state which action is requested, for example that the content in question should be removed or disabled, even though this is not an expressly mandatory element of a notice under Article 16.

In cases of intellectual property infringement, the notice should clearly state which right is relied on and how the content infringes it. Where the content concerns products or services, the notice should state in what way the information or activity is contrary to applicable rules.

The quality of a notice matters because it can affect the hosting provider's actual knowledge of illegal content.

The DSA builds on the exemption from liability model previously found in the E-Commerce Directive. A hosting provider is, as a starting point, not liable for information stored at a user's request, so long as the provider lacks actual knowledge or awareness of illegal activity or illegal content. Once the provider obtains such knowledge or awareness, it must act expeditiously to remove the content or to disable access to the illegal content.

A notice is considered to give rise to actual knowledge or awareness only if it enables a diligent hosting provider to identify the illegality of the activity or information without a detailed legal examination.

An overly general notice risks not achieving the intended effect. A notice that identifies the content, states the relevant legal basis and explains why the content is illegal, on the other hand, has good prospects of leading the provider to actually take a position on the matter. Where illegality can only be established after an extensive legal investigation or an assessment of complex and disputed facts, it is not certain that the notice alone will give rise to the knowledge required under Article 6.

Common legislation frequently relied on as a basis for alleged illegality includes the General Data Protection Regulation, the Swedish Marketing Practices Act, the provisions of the Swedish Penal Code on defamation and other privacy-related offences, and copyright and trademark law, although other grounds may also be available depending on the individual situation.

The provider must acknowledge receipt of the notice without undue delay. It must then take a decision, notify the notifying party of its decision and provide information on the possibilities for redress in respect of that decision. A decision may involve removing or disabling access to the content, but the provider may also conclude that there are insufficient grounds to take any action.

Online platforms covered by Article 20 of the DSA must provide access to an effective internal complaint-handling system that enables complaints to be lodged electronically and free of charge. Among other things, a notifying party can use this system to complain about a platform's decision not to take action. These provisions are subject to certain exemptions for micro and small enterprises. Out-of-court dispute settlement through bodies certified under the DSA is also available. The right to bring proceedings before a court is not affected by these options.

In addition, complaints about alleged infringements of the DSA can be lodged with the Digital Services Coordinator. In Sweden, the Swedish Post and Telecom Authority (PTS) has been designated as the Digital Services Coordinator and has overall responsibility for coordination and supervision of compliance with the DSA. The Swedish Consumer Agency and the Swedish Media Authority have also been designated as supervisory authorities. If a user has contacted a platform or digital service but has not received a response or action, a complaint can be lodged with PTS.

PTS cannot remove content, restore access to suspended accounts, or resolve individual disputes between users and platforms. Instead, the authority's role is to monitor that digital services have the procedures, tools and systems required by the DSA – for example, functioning notice and action mechanisms and the actual handling of notices received. If PTS finds that a platform is failing to comply with its obligations, the authority can order the platform to cease the infringement and combine the order with a penalty fine. In more serious cases, PTS can impose administrative fines of up to six percent of the provider’s annual worldwide turnover.

A complaint to PTS should include contact details, a description of what has happened, and documentation of the communication with the platform – for example screenshots and a copy of any moderation decision. PTS handles complaints from users in Sweden in accordance with the DSA rule that complaints are to be submitted in the Member State where the user is established. If the service is not active in Sweden, PTS can refer the matter to the competent authority in another EU Member State, since the authorities of all EU Member States cooperate to ensure consistent application of the DSA.

Copyright is a clear example of an area where there are special options for taking action against intermediaries beyond the DSA's notice and action mechanism.

In the case of copyright infringement, in addition to a complaint to the service provider, it is possible to seek an injunction subject to a penalty fine against the service provider whose services facilitate the infringement. This means that, for example, an internet service provider can be ordered to block its subscribers' access to the website or service where the infringement is taking place. Neither a contractual relationship between the intermediary and the infringer nor supervision by the intermediary over the information transmitted is required – it is sufficient that the provider's services are actually used to commit the infringement.

Proceedings are brought before the Patent and Market Court. Such an order requires a proportionality assessment that takes into account, among other things, the rightsholder's interest in preventing infringement, the service provider's interests, and internet users' freedom of information. The injunction, however, does not require the service provider to have acted intentionally or negligently. It is also possible, under certain conditions, to seek an interim injunction subject to a penalty fine pending final determination of the case.

Before sending a notice, the following questions should be considered.

✔ Which content do you want removed?

Identify the content as precisely as possible – for example by stating a URL, a product ID or a username.

✔ Have you documented the illegal content?

Preserve evidence of the material as soon as possible, for example through screenshots and other documentation. Content online can be changed or removed quickly.

✔ Why is the content illegal?

Identify the legal basis that makes the content illegal.

✔ Have you explained why the content is illegal?

Explain which legal rule is relied on and why the content in question falls within it. In cases of intellectual property infringement, state which right is being asserted and how the content infringes it. Relevant supporting documentation, such as registration certificates, should also be attached.

✔ Have you provided the exact electronic location?

Provide one or more exact URLs or other information that makes the content easy to find.