In addition to the general obligations that apply to all intermediary services, hosting providers are subject to additional, specific obligations, regardless of their size or field of activity.
Overview: DSA Obligations for Hosting Providers
Notification and Remedy Procedure
Regardless of their size or field of activity, hosting providers are subject to additional specific obligations under the Digital Services Act (DSA). A key element is the notification and remedy procedure under Art. 16 DSA. This procedure aims to ensure a safer online environment and protect the fundamental rights of EU citizens by requiring hosting services to set up user-friendly reporting systems. The goal is to remove illegal content directly at its source, as it is stored on the providers’ servers and therefore immediately accessible.
Art. 16 DSA seeks to harmonize a uniform legal framework across Europe for dealing with illegal content in order to replace fragmented national regulations. This creates economic opportunities through better access to the EU single market thanks to clear rules that simplify the cross-border provision of services, and establishes legal certainty through transparent and binding processes for reporting and countermeasures that apply regardless of the location of the provider or user.
The core mechanism is the “notice and takedown” procedure, which specifies the liability privileges for platforms. Users or institutions can report suspected illegal content that violates laws or terms of use using simple electronic tools. Providers are obliged to examine these reports quickly, objectively, and comprehensively, even when using automated systems. If a violation is confirmed, the content is removed and the reporting party receives reasoned feedback and information about possible legal remedies. These obligations apply without restriction to all hosting services. Examples of illegal content include hate speech and copyright and trademark infringements. Effective reports should contain precise information on the location (e.g., URL) and a clear explanation of why the content is illegal. Article 16 DSA thus establishes a binding escalation chain and places hosting providers under significant responsibility for dealing with illegal content.
Justification and Documentation
According to Art. 17 DSA, hosting service providers are required to provide all affected users with a clear and specific explanation when they restrict the information they provide, whether due to illegality or violations of the terms of use. This applies to any restrictions on display, removal of content, blocking of access, downgrading, suspension or termination of payments or the service as a whole, as well as the closure of user accounts. This obligation applies as soon as the relevant electronic contact details of the user are known, at the latest from the time of the restriction and regardless of its cause or nature, with the exception of misleading, extensive commercial content. The justification must include the nature and scope of the measure, the facts and circumstances of the decision (including information on notifications pursuant to Art. 16 DSA or voluntary investigations and, where applicable, the identity of the reporting person), the use of automated means, the legal basis in the case of allegedly illegal content, the violation of terms of use, and clear information about legal remedies available to the user (internal complaint procedures, out-of-court dispute resolution, judicial remedies). The information provided must be clear, easily understandable, and as accurate and specific as possible to enable the user to effectively exercise their rights. The obligation to provide reasons does not apply to orders pursuant to Article 9 of the DSA. By fulfilling these obligations, hosting providers contribute significantly to a transparent and secure online environment and strengthen user trust.
Obligation to Report Suspected Criminal Offences
In addition, Art. 18 DSA requires hosting providers to immediately inform the competent law enforcement or judicial authorities of the Member States concerned and to provide them with all relevant information if, in the course of their activities, they become aware of information that gives rise to a reasonable suspicion that a criminal offense has been committed, is ongoing, or is imminent.
Additional Obligations for Hosting Providers at a Glance
| Obligations | Specification according to DSA | Legal basis |
|---|---|---|
| Reporting and Remedy Procedures | Establishment of an easily accessible, user-friendly electronic system for reporting illegal content. Reports must be precise, substantiated, and comprehensible (including the location of the content, the reason for the report, and the contact details of the person reporting it). Providers must confirm receipt and inform the reporting person of their decision in a timely manner. | Art. 16 DSA |
| Reasoning and Documentation | If content is removed or access is restricted, the affected user must be informed immediately of the reasons. The reasoning must include the nature, reason, and circumstances of the moderation decision and provide information on possible legal remedies. | Art. 17 DSA |
| Obligation to Inform Authorities | If there is suspicion of criminal offenses that pose a threat to the life or safety of a person or persons, there is an obligation to report this immediately to the competent law enforcement authorities. | Art. 18 DSA |
| Transparency and Traceability | The procedures and measures for content moderation and the rules for the internal complaint management system must be made publicly available in clear, understandable language. | Art. 14, 17 DSA |
Consulting and Information on DSA Compliance
GDPR stands for: General Data Protection Regulation and refers to the basic data protection regulation which has been directly applicable in all EU member states since 25.05.2018. We would like to briefly highlight the essential aspects of the new regulations for you and present our consulting approach.