EU Digital Services Regulation Crackdown - A new reputational risk for your business?

Some commentators are saying that freedom of speech ‘absolutism’ online is facing a reckoning as the latest major EU regulation package targets big tech today: but the reputational risk could be far-reaching for smaller digital players too.

From today, platforms and apps that most of us use on a weekly or even daily basis are going to be subject to new and significant regulations. Google Maps, Zalando, Apple’s App Store, Booking.com, Instagram, Tiktok and Wikipedia are all household names. These tech and marketplace giants, along with 12 other well-known and popular digital conglomerates, will be forced to comply with a range of new EU regulatory rules that aim to enhance user content moderation, user privacy, and transparency.

Known as the Digital Services Act (DSA), the European Commission is attempting to keep pace with digital transformation and protect EU platform users. Initially, this legislation was about regulating what EU Vice-President for Values and Transparency Věra Jourová labelled “the Wild West”; in other words, for the EU it was about tackling the dominance of a small number of major tech companies with 45 million users or more (representing 10% of the population of the EU). These platforms can now face fines of up to 6 percent of their annual revenue if found to be in violation of the new rules.

Platforms such as TikTok and Amazon have both the resources and bandwidth to counter the increased scrutiny on how they protect users. What’s less known about this legislation is that the focus on ‘Very Large Online Platforms’, or VLOPs as they’re technically known, is only the beginning.

The aim from February 2024 is for regulation to be introduced for other companies offering digital services. Rules in the Act don't just relate to disinformation and countering cyber violence. Tracing sellers on online marketplaces, forcing companies to implement initiatives to combat scammers, and increasing transparency on how companies use algorithms to recommend content or products are incorporated into the legislation so the impact potentially could be far-reaching.

Beyond financial fines, the new legislation also has the potential to pose significant reputational risks. In the context of widespread conversation around digital consumer protection generally, there is expected to be major attention by media and other stakeholders on enforcement and sanctions.

For a range of companies, it will be important to start to assess and prepare now to ensure regulatory readiness. Some tips for digital companies to kick-start compliance procedures and prepare include the following:

- Assess whether the law applies to your company – and which provisions apply;

- Engage a multi-disciplinary team across the business to map existing and foreseeable risks in relation to compliance and ensure buy-in and participation from leaders, from the outset;

- Establish a single point-of-communication with regulators;

- Perform a readiness assessment to identify the services in scope and gaps against the applicable regulatory requirements, test its effectiveness and team preparedness;

- Consider how your company currently moderates content and assess the transparency of your terms and conditions to customers and users on how their data is being used;

- Engage all relevant employees in the process;

- Put in place a robust compliance and preparedness framework; include compliance and reputational risk management training as necessary;

- Test the effectiveness of processes and teams’ readiness to react to the range of operational and reputational scenarios that could arise.

The task ahead to assess risks for companies providing digital services may be both immense and complex. For Ireland’s regulator of digital services, the task will certainly be demanding: the newly-formed Coimisiún na Meán (Media Commission) has been assigned the task of policing, and with so many tech companies headquartered here, reputationally there will be pressure to ensure it delivers on its responsibility as essentially a pan-European regulator for many platforms.

At Reputation Inc, a key area of focus is assessing these types of reputational risks with clients. We can work with you and your team to conduct a thorough assessment of your company’s digital risk landscape to ensure your business and teams are prepared.