The European Data Protection Board (EDPB) has approved Guidelines 3/2025 on the relationship between the Digital Services Act (Reg. EU 2022/2065, “DSA”) and the GDPR (Reg. EU 2016/679), now open for public consultation.
The document clarifies several data protection issues that are essential to ensuring that compliance with the DSA is fully in line with data protection law.
This starts with the personal data protection aspects that providers must consider in order to ensure full compliance with the processes involved in voluntary investigations to combat illegal content or disable access to it, in notice and action mechanisms, as well as in the internal complaint management system.
Among the various aspects examined, the guidelines relating to the DSA's provisions for the protection of minors online are of particular interest.
It is clarified that, in order to comply with the obligation to adopt appropriate and proportionate measures to ensure a high level of privacy, security and protection of minors (Article 28 of the DSA), providers of online platforms accessible to these categories of persons must first verify the possibility of meeting these objectives without collecting or otherwise processing the personal data of children, in accordance with the principles of necessity and proportionality.
Where data collection is deemed necessary and proportionate, it is specified that providers may, under certain conditions, do so on the lawful basis relating to the need to comply with the legal obligations imposed on them by the DSA itself.
With regard to “age assurance” systems, it is specified that online platforms may also provide for processes that do not require user identification (e.g. through privacy-preserving technologies). More specifically, it is stated that providers should avoid implementing age assurance mechanisms that enable the precise identification of users (e.g., by requiring the transmission of a valid identity document), at least on the sole basis of Article 28 of the DSA.
In accordance with the GDPR, where age assurance measures are deemed necessary, the provider must adopt a risk-based approach to ensure that children are prevented from accessing the platform while avoiding any adverse effects on other users of the service.
Articoli Correlati