European parliament backs ‘historic’ reboot to EU’s digital rulebook

The European Parliament has given a final stamp of approval to two major pieces of regulation which will update the EU’s rules for digital businesses.

The Digital Markets Act (DMA) will introduce new ‘ex ante’ competition rules for gatekeeping tech giants to ensure markets are fair and open; while the Digital Services Act (DSA), which applies more broadly — to services and platforms both large and small — will set governance rules around the handling of illegal content and products, as well as dialling up broader accountability on larger platforms which have extra responsibilities under the framework.

The incoming regulations were proposed by the Commission at the end of 2020 so adoption has been swift — reflecting broad consensus by lawmakers around the bloc on the need for tougher and tighter rules for online services.

Today’s plenary vote of the parliament follows political agreement on the two files reached between the EU’s co-legislators earlier this year — back in March for the DMA; and April for the DSA.

You can read our earlier coverage of those political deals — which is the core of what the parliament has confirmed its backing for today — here:

The regulations are expected to start applying early next year after the formal adoption process is completed.

The European Commission, which drafted the laws, welcomed the parliament’s formal adoption of the files — with internal market commissioner, Thierry Breton, dubbing the “landslide” vote “historic“.

The parliament voted 588 in favor of the DMA; while 539 MEPs backed the DSA.

Commission EVP Margrethe Vestager also put out a statement — lauding what she described as a “global first”:

“The European Parliament has adopted a global first: Strong, ambitious regulation of online platforms. The Digital Services Act enables the protection of users’ rights online. The Digital Markets Act creates fair, open online markets. As an example, illegal hate speech can also be dealt with online. And products bought online must be safe. Big platforms will have to refrain from promoting their own interests, share their data with other businesses, enable more app stores. Because with size comes responsibility — as a big platform, there are things you must do and things you cannot do.”

From here, there are just a few steps left in the EU’s lawmaking procedure: Notably, formal approval of the texts by the Council — after which they will be published in the EU’s official journal, coming into force 20 days later (so the expected timeline for adoption is the fall; although, as noted above, application of the laws won’t start until 2023 — with some DSA provisions having a longer implementation period).

Enforcement resourcing questions

The Commission will be taking up a major enforcement role for both regulations — as the sole enforcer of the DMA and the lead for so-called very large online platforms (aka VLOPs) for the DSA.

Under the DMA fines for breaches can scale up to 10% of a tech giant’s global annual turnover — or even as much as 20% for repeat offenders. While penalties under the DSA can be up to 6% of global annual turnover. So the stakes are high for all concerned.

Many questions remain over enforcement resourcing, and how generally fit for purpose and ‘fleet of foot’ the EU’s executive will prove to be for such a massive new regulatory duty.

Likely in response to some of this concern, Breton has offered a “sneak peak” of how the Commission is approaching its new oversight duties.

Writing in a blog post published on LinkedIn today, immediately after the parliament vote, he said the Commission will set up dedicated teams within the EU’s Directorate General for Communications Networks, Content and Technology (aka, DG Connect) — which will be “organised around thematic domains”; including “the societal aspects, the technical aspects, and the economic aspects”.

“Issues such as risk assessments and audits will be handled by the societal issues team,” he writes in the post, offering a few examples of how these teams’ duties will shake out. “The technical team will take responsibility for issues such as interoperability of messenger services or the use of non-fungible tokens for product tracing, or the development of standards supporting the new rules.

“Finally, the economic team will cover DMA-related unfair trading practices, such as data accessor so-called FRAND conditions; or ensuring respect to the DSA-related liability exemptions or ‘know-your-business customer’ rules for marketplaces.”

He also notes that the teams will work closely together to avoid too siloed a response to platforms that he acknowledged “usually” create cross-cutting challenges — also with a “program office” taking a coordinating role and dealing with “international issues and litigation”.

So the Commission is clearly preparing for tech giants to push back against its centralized enforcement — and perhaps also to enlist their own politicians to use high level channels to complain (and potentially retaliate; tariffs anyone?) on their behalf.

The EU has said it will boost staffing levels next year and in 2024, and seek to ramp up internal technical expertise, to meet the demands of the enforcement challenge — in addition to redeploying some existing staff and resource to the new duties.

But in the blog post Breton said he expects the dedicated DMA and DSA DG Connect team to have more than 100 full time staff following this recruitment drive.

Nonetheless, questions are likely to remain over whether that level of resource will be enough for the incoming major workload attached to regulating scores of large (and some truly massive) platforms.

The Commission is partially recouping the cost of staffing DSA enforcement by levying a fee on larger platforms and big search engines. Breton’s post notes this without specifying the fee platform giants will have to pay — but reports have suggested platforms were successful at lobbying to shrink how much they’ll have to shell out for being policed. So the resourcing concern seems likely to stick around.

Another new component of the EU’s oversight of platforms which Breton does include in his sneak peak involves establishing what he refers to as “a high-profile European Centre for Algorithmic Transparency” — which the EU wants to underpin the DSA’s algorithmic transparency requirements for VLOPs. “This new Centre will attract world-class scientific talent in data science and algorithms that will complement and assist the enforcement teams,” he suggests.

Again, though, whether the Commission will be able to pay enough to attract the necessary talent for the scale and complexity of grappling with platforms’ black boxes remains to be seen.

At a press conference following the parliament vote, rapporteurs for the DMA and DSA, MEPs Andreas Schwab and Christel Schaldemose, were asked about resourcing — and whether they’re confident the Commission will both have enough staff, and be able to attract the level of technical expertise necessary, to effectively oversee platforms and services.

They responded by saying they hoped enough resource would be marshalled — while not denying the scale of the challenge facing the EU’s executive as it takes up this new oversight role.

“The key question now [for the DMA] — it’s about how the Commission can take up the challenge and enforce this law for the first time only alone. Because competition policy cases have always been done in comparison and in cooperation with Member States. And we don’t know yet but we believe that we can managed this if we use the rules that the European Commission has at its hands to hire people that are able,” said Schwab, singling out the DMA as the bigger of the two challenges.

The Commission itself has also suggested it won’t be easy to rein in Big Tech — with commissioner Vestager hinting back in February it’s expecting the world’s most powerful tech platforms to try to circumvent the incoming ex ante rules, rather than neatly falling in line.

On talent, Schwab suggested there will be a pool of willing qualified experts for the Commission to draw from — name-checking the likes of Facebook whistleblower Frances Haugen, who has previously floating the idea, in public discussions with lawmakers on how best to regulate platform power, that staffers who become concerned about algorithmic impacts they’re witnessing as part of their jobs inside tech companies could, ultimately, find a perch in external oversight agencies and repurpose their insider knowledge for a greater good.

“I have no doubt that with, not only Frances Haugen and other examples, there will be more and more people in the world and also in gatekeepers that will say listen, hey, why shouldn’t we make these markets better and fairer?” argued Schwab. “Therefore I am optimistic that not only will the Commission find the right people, and will also bring in more people to enforce these systems… but also the gatekeepers and people that know about algorithms and technology will take responsibility themselves and will speak out and that that altogether will help to create more transparency.”

But, in budget discussions, Schwab said the parliament has been asking for 150 people — purely for DMA enforcement. So MEPs appear to be pushing for more staff than the Commission itself.

“On enforcement, in the DSA we’re saying that the very large online platforms the Commission will have the power to enforce and we have also provided the Commission with funds for this — we agreed on a supervisory fee — because we expected that it could be difficult otherwise to have enough qualified staff to help the enforcement,” added Schaldemose. ” I guess that with these funds and the structure in place we will see that the Commission will be able to deliver.

“And — if not — we will — I will monitor them from here and I will ask questions and I will make sure that they are doing what we expect them to do. But I’m optimistic because, I have to say, talking to the Commission — and especially the two commissioners responsible, Vestager and Breton, they’re very eager to start working.

“They really want to do something for the very large online platforms… The rest is up to Member States, and then we have the classical structure with the country of origin principle in place. So I guess with the news structure it will be better. We have the funds and of course the Commission will have to compete with all the big companies for the good staff but that’s how it is.”

Asked specifically how many people the rapporteurs believe the Commission needs to oversee the DSA and the DMA, Schaldemose pointed to initial Commission estimate, of 70 people — but Schwab reiterated the parliament’s recommendation that many more staff than that will be needed.

“In the end, the DMA will work in a structure that on every core platform service of every gatekeeper there will be probably a need to have a team — maybe not on every core platform service at the beginning but nearly on every one,” he suggested. “That means you need a case handler, you need a manager, you need a data analyst — so you need easily 10 people for one file; one per gatekeeper, per core platform service. And that means that the 150 [staff looks inadequate].”

“Therefore I think this is the right demand from the side of the parliament,” he added. “It’s our task here to make these laws be respected by those companies that are targeted with it.”

On application of the DMA, and the looming designation process — whereby the Commission will need to do the work to confirm a gatekeeper core service does fall in scope — Schwab said the parliament expects the gatekeeper designation process to commence on March 1, 2023, following the six month implementation period after the law is published in the EU’s Official Journal.

But he said the parliament also expects the Commission to have undertaken preparatory work — so that, by mid March 2023, it come could with the first designation.

Giving a hint on which tech giant will have the ‘honor’ of being first in line for the DMA rules to apply, Schwab suggested it will “definitely be one of the GAFAM companies; maybe without the ‘M’ — referring to the acronym that’s used to refer collectively to Google, Apple, Facebook, Amazon and Microsoft (but here he’s de-emphasizing Microsoft).

“Maybe you start at the beginning — or in the middle; it will be very easy,” he went on, suggesting he’s expecting either Google (Alphabet) or Facebook (Meta) to be at the front of the queue. “But the key question — or the more difficult question will be — what core platform service will they choose first from one of these companies? And that’s, I think, a very open question.”

This report was updated with additional reporting from the press conference