The Digital Services Act (Regulation (EU) 2022/2065, DSA) constitutes one of the cornerstones of the EU digital regulatory framework, governing issues such as the liability of providers and the due diligence obligations imposed on providers of intermediary services (e.g. online platforms). In relation to these due diligence obligations, the DSA also lays down specific rules concerning terms and conditions and online advertising.
Many of the provisions introduced by the DSA raise complex personal data protection issues, an area primarily regulated by the General Data Protection Regulation (Regulation (EU) 2016/679, GDPR). Since the DSA does not derogate from the obligations established under the GDPR, the two Regulations apply concurrently, giving rise to significant interpretative challenges for service providers.
To clarify the interaction between the DSA and the GDPR, the European Data Protection Board (EDPB), which brings together the EU data protection supervisory authorities, has recently adopted dedicated guidelines.
The EDPB Guidelines address a number of issues of considerable practical relevance, ranging from the processing of personal data in the context of mandatory notice-and-action mechanisms to the rules on dark patterns, the transparency requirements applicable to online advertising, and the prohibition on the use of special categories of personal data for profiling-based advertising.
Among the matters examined, and one that had generated significant uncertainty, is the processing of personal data relating to children. The Guidelines clarify that such processing may rely on the legal basis of compliance with obligations imposed by the Regulation for the protection of minors, albeit subject to specific limitations. In particular, regarding age assurance mechanisms, the EDPB specifies that providers of online platforms should avoid methods involving the unique online identification of users and should not estimate or verify users’ ages and permanently retain related information on the basis that such processing is necessary to comply with obligations under the DSA. For age verification or estimation purposes that do not require user identification, providers may instead deploy privacy-preserving technologies that reflect the state of the art, such as cryptographic methods based on zero-knowledge proofs. It should nevertheless be borne in mind that, in the longer term, providers will also need to align their practices with the new framework expected to be introduced by the forthcoming EU Kids Act, which is currently under discussion at EU level.
Further guidance concerns cooperation between the authorities responsible for monitoring compliance with data protection legislation (in Italy, the Garante privacy) on the one hand, and those responsible for enforcing the DSA on the other, namely the Digital Services Coordinator (in Italy, the Italian Competition Authority, AGCM) and the European Commission. Particular emphasis is placed on the mutual consultation obligations incumbent upon these authorities, which are regarded as essential both to ensure compliance with the ne bis in idem principle and to prevent a provider from being sanctioned twice for the same conduct under the two regulatory frameworks. Such a scenario could arise, for example, where a provider targets minors with profiling-based advertising.
Articoli Correlati