Personal Data Processing of Online Platforms’ and Search Engines’ Users: The case of the EU Digital Services Act
Copyright (c) 2024 Farinho Domingos Soares
This work is licensed under a Creative Commons Attribution 4.0 International License.
Abstract
The new EU Digital Services Act (DSA) aims to regulate intermediary service providers and special attention is given to online platforms and search engines. The bulk activity of these two online players is personal data processing, under the guise of content moderation or recommendations to users. This means that both the EU GDPR and DSA interconnect when protection of personal data is concerned and it is the task of lawyers to determine how is the interplay between these two keys pieces of legislation in the EU digital domain. The paper sets out to try to understand how both EU Regulations connect and what is the end result. Beyond the introduction, section 2 describes how the GDPR applies to online platforms, focusing on grounds for lawful personal data processing. In section 3 the main interplay is presented and analysed and the normative relation between the GDPR and the DSA is assessed with special attention being given to specific data protection duties and prohibitions arising from the DSA and its regulatory framework.
Keywords:
How to Cite
References
Bassini, M. (2019). Fundamental Rights and Private Enforcement in the Digital Age. European Law Journal, 25(2), 182–197. Online: https://doi.org/10.1111/eulj.12310
Becker, S. & Penfrat, J. (2023). Still Useful. In J. van Hoboken, J. P. Quintais, N. Appelman, R. Fahy, I. Buri & M. Straub (Eds.), Putting the DSA into Practice. Enforcement, Access to Justice and Global Implications (pp. 51–62). Verfassungsbooks. Online: https://doi.org/10.17176/20230208-093135-0
Binns, R. & Veale, M. (2021). Is That Your Final Decision? Multi-stage Profiling, Selective Effects, and Article 22 of the GDPR. International Data Privacy Law, 11(4), 319–332. Online: https://doi.org/10.1093/idpl/ipab020
Büchi, M., Fosch-Villaronga, E., Lutz, C., Tamò-Larrieux, A., Velidi. S. & Viljoen, S. (2020). The Chilling Effect of Algorithmic Profiling: Mapping the Issues. Computer Law & Security Review, 36. Online: https://doi.org/10.1016/j.clsr.2019.105367
Buri, I. (2023). A Regulator Caught Between Conflicting Policy Objectives. In J. van Hoboken, J. P. Quintais, N. Appelman, R. Fahy, I. Buri & M. Straub (Eds.), Putting the DSA into Practice. Enforcement, Access to Justice and Global Implications (pp. 75–90). Verfassungsbooks. Online: https://doi.org/10.17176/20230208-093135-0
Bygrave, L. (2020). Commentary to Article 4(4). In C. Kuner, L. A. Bygrave & C. Docksey (Eds.), The EU General Data Protection Regulation (GDPR). A Commentary (pp. 125–131). Oxford University Press. Online: https://doi.org/10.1093/oso/9780198826491.003.0010
Dijck, J. van, Poell, T. & Waal, M. de (2018). The Platform Society. Public Values in a Connective World. Oxford University Press. Online: https://doi.org/10.1093/oso/9780190889760.001.0001
Egídio, M. M. (2022). Social Networks and the Exercise of Fundamental Rights: Public Administration and the Digitalization of Fundamental Rights. In C. B. de Morais, G. F. Mendes & T. Vesting (Ed.), The Rule of Law in Cyberspace (pp. 217–238). Springer. Online: https://doi.org/10.1007/978-3-031-07377-9_12
Eifert, M., Metzger, A., Schweitzer, H. & Wagner, G. (2021). Taming the Giants: The DMA/DSA Package. Common Market Law Review, 58(4), 987–1028. Online: https://doi.org/10.54648/cola2021065
Farinho, D. S. (2022). Fundamental Rights and Conflict Resolution in the Digital Services Act Proposal: A First Approach. e-Pública, 9(1), 75–103. Online: https://shorturl.at/ijAQR
Farinho, D. S. & Campos, R. R. (2022). Models of Legal Liability for Social Networks: Between Germany and Portugal. In C. B. de Morais, G. F. Mendes & T. Vesting (Eds.), The Rule of Law in Cyberspace (pp. 331–348). Springer. Online: https://doi.org/10.1007/978-3-031-07377-9_17
Goldman, E. (2020). An Overview of the United States’ Section 230 Internet Immunity. In G. Frosio (Ed.), The Oxford Handbook of Online Intermediary Liability (pp. 155–171). Oxford University Press. Online: https://doi.org/10.1093/oxfordhb/9780198837138.013.8
Gregorio, G. De (2020). Democratising Online Content Moderation: A Constitutional Framework. Computer Law & Security Review, 36. Online: https://doi.org/10.1016/j.clsr.2019.105374
Hartmann, I. A. (2020). A New Framework for Online Content Moderation. Computer Law & Security Review, 36(April), 105376. Online: https://doi.org/10.1016/j.clsr.2019.105376
Hildebrandt, M. & Gutwirth, S. (Eds.) (2008). Profiling the European Citizen. Springer. Online: https://doi.org/10.1007/978-1-4020-6914-7
Jaursch, J. (2023). Platform Oversight. In J. van Hoboken, J. P. Quintais, N. Appelman, R. Fahy, I. Buri & M. Straub (Eds.), Putting the DSA into Practice. Enforcement, Access to Justice and Global Implications (pp. 91–106). Verfassungsbooks. Online: https://doi.org/10.17176/20230208-093135-0
Jørgensen, R. F. (2019). Rights Talk. In R. F. Jørgensen (Ed.), Human Rights in the Age of Platforms (pp. 163–188). MIT Press.
Klonick K. (2018). The New Governors: The People, Rules, and Processes Governing Online Speech. Harvard Law Review, 131(6), 1598–1670. Online: https://shorturl.at/bnEO3
Kosseff, J. (2016). The Gradual Erosion of the Law that Shaped the Internet: Section 230’s Evolution Over Two Decades. The Columbia Science & Technology Law Review, 18(1), 1–41. Online: https://doi.org/10.7916/stlr.v18i1.4011
Kurtz, C., Wittner, F., Semmann, M. & Schulz, W. (2019). The Unlikely Siblings in the GDPR Family: A Techno-Legal Analysis of Major Platforms in the Diffusion of Personal Data in Service Ecosystems. Proceedings of the 52nd Hawaii International Conference on System Sciences, 52, pp. 5059–5068.
Kurtz, C., Wittner, F., Semmann, M., Schulz, W. & Böhmann, T. (2022). Accountability of Platform Providers for Unlawful Personal Data Processing in Their Eco-Systems – A Socio-Techno-Legal Analysis of Facebook and Apple’s iOS According to the GDPR. Journal of Responsible Technology, 9. Online: https://doi.org/10.1016/j.jrt.2021.100018
Land, M. K. (2019). Regulating Private Harms Online: Content Regulation under Human Rights Law. In R. F. Jørgensen (Ed.), Human Rights in the Age of Platforms (pp. 285–316). MIT Press.
Pollicino, O. & Gregorio, G. De (2022). Constitutional Law in the Algorithmic Society. In H.-W. Micklitz, O. Pollicino, A. Simoncini, G. Sartor & G. De Gregorio (Eds.), Constitutional Challenges in the Algorithmic Society (pp. 3–24). Cambridge University Press. Online: https://doi.org/10.1017/9781108914857.002
Quintais, J. P., Appelman, N. & Ó Fathaigh, R. (2023). Using Terms and Conditions to Apply Fundamental Rights to Content Moderation. German Law Journal, 24(5), 881–911. Online: https://doi.org/10.1017/glj.2023.53
Scholz, P. (2019). Kommentar zum artikel 4 Nr. 4. In S. Simitis, G. Hornung & I. g. D. Spiecker (Eds.), Datenschutzrecht. DSGVO mit BDSG (pp. 306–311). Nomos.
Taddeo, M. & Floridi, L. (2017a). New Civic Responsibilities for Online Service Providers. In M. Taddeo & L. Floridi (Eds.), The Responsibilities of Online Service Providers (pp. 1–10). Springer. Online: https://doi.org/10.1007/978-3-319-47852-4_1
Taddeo, M. & Floridi, L. (2017b). The Moral Responsibilities of Online Service Providers. In M. Taddeo & L. Floridi (Eds.), The Responsibilities of Online Service Providers (pp. 13–42). Springer. Online: https://doi.org/10.1007/978-3-319-47852-4_2
Turillazzi, A., Taddeo, M., Floridi, L. & Casolari, F. (2023). The Digital Services Act: An Analysis of Its Ethical, Legal, and Social Implications. Law, Innovation and Technology, 15(1), 83–106. Online: https://doi.org/10.1080/17579961.2023.2184136
United Nations Human Rights Council (2018). Report of the Special Rapporteur on the Promotion and Protection of the Right to Freedom of Opinion and Expression.
Valcke, P., Clifford, D. & Dessers, V. K. (2022). Constitutional Challenges in the Emotional AI Era. In H.-W. Micklitz, O. Pollicino, A. Simoncini, G. Sartor & G. De Gregorio (Eds.), Constitutional Challenges in the Algorithmic Society (pp. 57–77). Cambridge University Press. Online: https://doi.org/10.1017/9781108914857.005
Wischmeyer, T. (2020). What is illegal offline is also illegal online: the German Network Enforcement Act 2017. In B. Petkova & T. Ojanen (Eds.), Fundamental Rights Protection Online (pp. 28–56). Edward Elgar Publishing. Online: https://doi.org/10.4337/9781788976688.00012
York, J. C. & Zuckerman, E. (2019). Moderating the Public Sphere. In R. F. Jørgensen (Ed.), Human Rights in the Age of Platforms (pp. 137–162). MIT Press.
The author wishes to express his thanks to the two anonymous reviewers and to the participants of the Lisbon Digital Rights Research Group’s (Lisbon Public Law, University of Lisbon) Workshop on Ongoing Work (May 2023) for all their comments on and suggestions for a previous version of the paper.