Archive:November 2022

Update from the Australia/New Zealand privacy conference and the changes to Australian privacy and cybersecurity laws
EU Digital Services Act: Fundamental Changes for Online Intermediaries?

Update from the Australia/New Zealand privacy conference and the changes to Australian privacy and cybersecurity laws

By Cameron Abbott, Rob Pulham and Stephanie Mayhew

We’ve just returned from the annual iapp Australia/New Zealand privacy conference held in Sydney this week, and it was a whirlwind. Even if you’re not one of around half of Australians affected by two of the biggest data breaches in our recent history, you’ll be aware a lot is changing – and a lot more is poised to change – in this space.

We’ll be blogging over the coming weeks about some of the key themes and changes your organisation will need to prepare for, including:

– new regulatory enforcement tools

– higher expectations of the way personal information is collected and secured, and when it needs to be destroyed

– potential removal of key exemptions such as the employee records exemption that your business may currently rely on,

– and of course the major penalty increases that seek to deter privacy breaches being viewed as ‘the cost of doing business’,

as Australia tightens the protections around the collection and use of Australians’ personal information.

Stay tuned!

EU Digital Services Act: Fundamental Changes for Online Intermediaries?

By Claude-Étienne Armingaud, Dr. Ulrike Elteste and Dr. Thomas Nietsch

The European Union has taken another step to set out its new legal framework for online intermediaries. Following the publication of the Digital Markets Act (Regulation (EU) 2022/1925) in the EU Official Journal on 12 October 2022, the Digital Services Act has now also been published in the EU Official Journal as Regulation (EU) 2022/2065.

While the Digital Markets Act focuses on the behavior of large “gatekeepers” towards other businesses, the Digital Services Act aims to fully harmonize the rules on the safety of online services and the dissemination of illegal content online. In particular, its Articles 4 to 10 replace the current provisions on the liability privilege enjoyed by online intermediaries in the eCommerce Directive 2000/31/EC. The privilege as such broadly remains intact, but is punctured in a number of ways. For example, the Digital Services Act encourages preemptive screening and provides that “trusted flaggers” must receive priority in the future. Providers of online platforms that allow consumers to enter into distance contracts with traders must obtain certain minimum information from the traders they admit to their platform. They may have to notify consumers if they become aware that products sold on their platform do not comply with legal requirements.

Again, “very large” online platforms and search engines receive the legislator’s (and the EU Commission’s) special attention. They must comply with additional transparency requirements and analyze and mitigate systemic risks.

But other intermediaries must also timely amend their terms of service, improve their complaint handling, and increase their transparency to avoid fines that can reach 6% of their global turnover. Specifically, online platforms must in the future provide clear information on “each specific advertisement presented to each individual recipient”, including “meaningful information directly and easily accessible from the advertisement about the main parameters used to determine the recipient to whom the advertisement is presented and, where applicable, about how to change those parameters”.

Most obligations bearing on companies subject to the Digital Services Act will start to apply on 17 February 2024. However, all but small online platforms and search engines will be required to publish information on the usage of their services (Statement) on their website, with an initial Statement to be published by 17 February 2023 at the latest. Intermediaries designated as “very large online platforms” or “very large online search engines” by the EU Commission will need to comply with most of their new obligations from four months after being notified of their “very large” status.

Copyright © 2024, K&L Gates LLP. All Rights Reserved.