Platforms, Online Surveillance, and the European Union: The Digital Services Act (DSA)

Table of Contents: 1. Introduction. – 2. State of the art. – 2.1. European online surveillance between content moderation and digital constitutionalism. – 2.2. Platforms and the shaping of information dissemination. – 3. Platforms, online surveillance, and the DSA. – 3.1. Proliferation of government measures targeting online expression. – 3.2. Proliferation of government surveillance. – 3.3. The Digital Services Act (DSA). – 4. Compatibility with human rights. – 4.1. The right to privacy and government monitoring of online platforms. – 4.2. Freedom of expression and government leveraging of platforms. – 4.3. Targeting expression based on broad categorisation of content as illegal. – 5. Conclusion.

Abstract: Over the past few years, governments have been keen on leveraging the power of platforms to further develop their online surveillance practices. The European Union (EU) is becoming a world-leading regulatory powerhouse in this respect. After having adopted in 2021 a Regulation on the countering of online terrorist content (TERREG), the EU legislature adopted the Digital Services Act (DSA) in 2022, which introduces measures boosting the online surveillance capacities and competences of both platforms and governments. While these initiatives are expected to protect the online environment, they risk imposing new forms of restrictions on freedom of expression and the right to respect for private life. Moreover, closer forms of platform/government cooperation raise multiple concerns, notably in light of growing debates about the scope and depth of online surveillance provided by platforms’ technological affordances. This article applies a trans-disciplinary perspective, bringing together law, political communication and media studies, to better understand the emergence of novel forms of European digital surveillance. First, the article examines how platforms’ algorithmic systems shape (and limit) information dissemination. We then critically analyse how EU initiatives expand platforms’ surveillance capacities to foster governments’ own digital surveillance practices. We focus on the DSA and those regulatory solutions that create novel forms of surveillance. Third, the article assesses how these measures comply with freedom of expression and the right to respect for private life. We conclude by providing recommendations on how to remedy problematic elements of the role that platforms will increasingly play in the digitisation of government surveillance.

Keywords: platforms – surveillance – human rights law – freedom of expression – privacy – Digital Service Act (DSA). 

1.   Introduction 

Over the past few years, governments have been keen on leveraging the power of platforms to further develop their online surveillance practices. The European Union (EU) is progressively becoming a world-leading regulatory powerhouse in this respect: after adopting in 2021 a Regulation on the countering of online terrorist content (TERREG),^[1] the EU adopted in 2022 the Digital Services Act (DSA),^[2] which introduces measures boosting the online surveillance capacities and competences of both platforms and governments. While these two EU Regulations are expected to protect the online environment, they risk imposing new limitations on freedom of expression and the right to respect for private life as guaranteed under European and international human rights law.[3] Moreover, the Regulations, as well as other EU and national initiatives – such as the EU Internet Forum (an EU-platform collaboration to combat terrorist propaganda)[4] and national legislation in France, Germany or Italy[5] – are fostering and institutionalising closer forms of platform/government cooperation^[6] in the field of online content moderation.^[7] This phenomenon raises multiple concerns, notably in light of growing debates about the scope and depth of online surveillance provided by platforms’ technological affordances. 

This article focuses on the DSA to investigate how the law facilitates public and private surveillance practices over content disseminated in online platforms. We focus on the DSA because this Regulation provides overarching obligations for digital services that act as intermediaries in their role of connecting consumers with goods, services, and content, while it also foresees possibilities for the government to exercise control over online content. We take a closer look at the DSA from a trans-disciplinary perspective to understand its fundamental rights and surveillance implications. As we show through the remainder of the article, public-private partnership structures that deal with online harms are not novel to the DSA, some of it has origins in self-regulatory initiatives (e.g. EU Code of Conduct on Countering Illegal Hate Speech Online and trusted flaggers)[8] or in national or EU legal frameworks (e.g. criminal procedural law on the orders to provide information). What the DSA does is to introduce an overarching legal framework to govern some aspects of these practices. 

This article explores and unpacks the nexus between platforms, the EU and online surveillance. In doing so, it aims at fostering a nascent scholarly conversation at the intersection of law and social sciences, characterised by research that adopts a critical perspective to better grasp the emergence of novel forms of surveillance in digital societies.^[9] We thus adopt a trans-disciplinary perspective, combining law, political communication and new media studies, in order to better understand the emergence of novel forms of digital surveillance in the EU. The article is divided as follows: section 2 examines how platforms’ algorithmic systems shape, and limit, information dissemination. Section 3 then critically analyses how EU initiatives expand platforms’ surveillance capacities to foster governments’ own digital surveillance practices, including with a focus on the DSA and those regulatory solutions that create novel forms of surveillance. Section 4 assesses how these measures comply with freedom of expression and the right to privacy. Section 5 concludes.

2.   State of the art

Studying platform-government relations in the domain of European online surveillance means engaging with several and diverse strands of scholarly research. Given the objective of this article, we propose to foreground and briefly discuss three lines of research that more closely relate to the scope of our analysis – literatures on online content moderation and on digital constitutionalism on the one hand, and research on the role of platforms and the shaping of information dissemination on the other hand. Each of these lines of research has a sort of disciplinary kernel, respectively (new) media studies, law and communication science. Yet, these lines both intersect each other and cross(-fertilise) diverse disciplinary domains, thus inviting further trans-disciplinary research.

2.1.  European online surveillance between content moderation and digital constitutionalism

Academic literature on content moderation is currently blossoming. In the most general terms, content moderation can be defined as ‘the detection of, assessment of, and interventions taken on content or behaviour deemed unacceptable by platforms or other information intermediaries, including the rules they impose, the human labour and technologies required, and the institutional mechanisms of adjudication, enforcement, and appeal that support it’.^[10]

By understanding content moderation as an essential practice of online platforms, this literature emphasises the fact that platforms are far from being a neutral informational space driven by active users. In other words, most of the literatures focusing on content moderation assumes – implicitly or explicitly – that platforms have become particularly power actors, whose seemingly mundane decisions may have far reaching consequences both in relation to their users and to the capacity of public authorities to exercise a form of control over online environment. Hence, as now classical works in this domain suggest, platforms could be better understood as complex socio-technical environments which are far from being ‘politics-free’.[11] Hence, somewhat paradoxically, this literature contributes to re-signify the very term platform, now emphasizing how much this kind of actors are far from neutral, but are rather leveraging various forms of governance, notably vis-à-vis online users’ behaviour, but also in relation to social order and public policies.[12] In this vein, literature on content moderation tries to foreground and unpack how different forms of regulation are exercised in given socio-technical systems.[13] Notably, some of the most innovative research focuses on the relations of power involving users and platforms,[14] that is, how platforms try to control and shape the behaviour of their users, while – at the same time – users develop tactics to bypass some forms of content moderation. Another strand of research casts a light on the otherwise invisibilised relations between the human workforce and the algorithms carrying out the ‘detection’, ‘assessment’ and ‘interventions’ mentioned above.[15] This research increasingly puts into question approaches seeing algorithms as both autonomous and almighty, and rather invites to better grasp the content moderation logics through a focus on actual practices, so to ultimately track their specific dynamics.[16] Finally, some works explores how content moderation is becoming a field in which IT companies and public authorities do not only attempt to shape each other policies – for example by defining new rules for platforms or by influencing policy-making – but also develop new surveillance tools and practices.[17]

Alongside (new) media studies and sociological approaches on content moderation, there is a growing literature about digital constitutionalism.[18] From a more legal perspective, both the critical role of platforms with regard to the dissemination of information, and their seemingly capacity to enforce their decision on social networks used by individuals and even public authorities, trigger questions about the need to preserve individuals’ fundamental rights in these novel spaces. In this context, digital constitutionalism can be understood as ‘the ideology that adapts the values of contemporary constitutionalism to the digital society’.[19] In a sort of feedback loop, the operations through which human rights and values are inscribed into content moderation participate in a ‘process of constitutionalisation in the digital environment’, which could affect constitutionalism (and this ‘even if norms are not yet institutionalised or positivised in the hierarchy of legal sources’ and even if the process itself ‘is not unitary’.[20]Notably, other scholars have sought to deepen the analysis further with a distinct focus on international and European human rights standards, particularly on how human rights law may be operationalised by platforms in their content moderations decisions and practices.[21]

These literatures are already speaking to each other. Besides the fact that they all highlight the crucial role of platforms in shaping our digital societies, they also participate in better understanding the challenges raised by online surveillance for democracies, and how democratic systems should regulate surveillance. Our contribution aims to join this scholarly conversation, which has strong societal and policy relevance. Notably, our goal is to supplement insights of these literatures by discussing ongoing developments at EU level,[22] and how European legislation creates new opportunities to foster government online surveillance. In doing so, we pursue a trans-disciplinary ethos to better grasp the complexity of the EU landscape of online surveillance, which is characterized not only by a wave of novel legislation but also by the unfolding of public-private partnerships giving way to new surveillance practices. Further, we build upon the literature which seeks to demonstrate how legislation, such as the DSA, can be operationalised consistent with international and European human rights standards.

2.2.  Platforms and the shaping of information dissemination

Platforms have become an essential source of information for news users. In Europe, 40% of news users report they regularly use Facebook for news, 23% use YouTube, 14% use Instagram to access news and 5% frequently turn to TikTok to inform themselves about the world in 2022.^[23] This trend is expected to continue as social media platforms offer convenience and the ability to customise your newsfeed to topics users are interested in. The affordances of platforms help users to manage information overload, which is appreciated by users in Europe and beyond.^[24] At the same time, users also report that the technological systems that select and present information to them remain opaque to them.^[25]

Platforms use algorithmic systems that shape how information is disseminated to their users. These systems mainly serve two main different goals. First, platforms are designed to prioritise content that is likely to be of interest to users and will engage them on the platform. This is achieved through personalisation algorithms that select and adjust content based on past engagement and content selections, the network of the users, and the behaviour of other, similar users. Second, algorithmic systems are used in combination with human supervision to identify content that is in conflict with their user guidelines, such as hate speech, cyberbullying, or disinformation.

Both of these mechanisms, personalisation and content moderation, have a significant impact on what information is accessible to different users. While personalisation arguably increases the relevance of the information presented, it might also create echo chambers where users are exposed only to information that reinforces their existing beliefs and biases. This can limit the diversity of information that users are exposed to. However, empirical evidence suggesting platforms severely affecting content diversity is nuanced. These effects have been noted for specific user groups on specific platforms, but on the other hand, by and large users are not locked in highly individualised so-called filter bubbles.[26]

While personalisation of information determines how visible content is to users, content moderation affects the boundaries for what type of content is allowed. These two mechanisms intersect, when content moderation measures lead to the de-prioritisation of content (often called shadow banning). While less studied so far in the literature, this latter mechanism is particularly noteworthy from a normative and legal standpoint, because users are often not informed that their content is deprioritised, and to what degree the depriorisation takes effect. Because content moderation relies on algorithms to determine what violates platform standards, it is prone to both over-enforcement, whereby non-harmful content is deprioritised or removed, and under-enforcement, whereby content that breaches standards or even the law continues to circulate.

3.   Platforms, online surveillance, and the DSA

Before examining how European governments leverage platforms to engage in online surveillance and data-gathering, we first explain how this surveillance is built upon a proliferation of new government measures throughout the EU targeting online expression under the guise of illegal and harmful content. This proliferation is key to understanding the growth of government leveraging of platforms for online surveillance, and is notable not only for how widespread in the EU it has become, but also the serious level of criticism that is being levelled at these measures by international human rights bodies and civil society organisations. 

3.1.  Proliferation of government measures targeting online expression 

It is helpful to begin with an overview of EU member states, with approaches from both large and small member states. First, in France, one of the most notable laws targeting online expression is the 2018 Law on the fight against the manipulation of information,^[27] which applies to so-called false information on platforms during election periods. The law provides that during an election period, a court can order an online platform to remove ‘inaccurate or misleading allegations or imputations of fact’, which may ‘alter the sincerity of an upcoming vote’, and are ‘disseminated deliberately, artificially or automatedly’, and on a massive scale.^[28] Notably, France has not been alone in adopting laws on false news and false information. And there has been such disquiet among human rights bodies over the recent wave of such laws, that four international special mandates on freedom of expression recently came together to make clear that under international human rights standards: prohibitions on the dissemination of information based on ‘vague and ambiguous’ provisions, including ‘false news’ or false information are ‘incompatible with international standards’, and ‘should be abolished’.^[29]

France went even further in 2020, when the Law on Countering Online Hatred was adopted.[30] The law imposed obligations on platforms to remove ‘manifestly illegal’ hate speech and other illegal content within 24 hours of receiving a notice, and incredibly, to remove certain terrorist content and child pornography within one hour.[31] The law was subject to trenchant criticism from civil society organisations, arguing it ‘seriously undermines’ freedom of expression.[32] Importantly, in June 2020, the French Constitutional Council found the law violated the right to freedom of expression, due to the immense ‘difficulties’ for platforms to assess what was ‘manifestly unlawful’ content within such short time-frames, and would only ‘encourage’ platform to remove reported content, ‘whether or not’ it is ‘clearly illegal’.[33]

Second, Germany has enacted one of the most widely known laws targeting expression on platforms, namely the Network Enforcement Act.[34] The law imposes an obligation on platforms to ensure there is a mechanism for users to report ‘unlawful content’, which is defined as content criminalised under 22 criminal offences under the German Criminal Code, including insult and defamation. Crucially, an obligation is imposed on platforms to check ‘whether the content reported in the complaint is unlawful’ and whether access to the content ‘must be blocked’.[35] In particular, platforms must remove or block access to content that is ‘manifestly unlawful’ within 24 hours of receiving the complaint. Notably, the Act does not define ‘manifestly unlawful’. Again, similar to the French laws, the German law was subject to strong criticism from civil society organisations, scholars, and indeed, the UN Special Rapporteur on freedom of expression was quite forthright with criticism, stating: ‘liability placed upon private companies to remove third party content absent a judicial oversight’ was ‘not compatible with international human rights law’.[36]The UN Human Rights Committee also criticised the law.[37] Nonetheless, Germany went further in 2021, when it enacted a new Law to combat right-wing extremism and hate crime, which amended the Network Enforcement Act.[38] Notably, the law imposes further obligations on online platforms, in particular an obligation to send certain suspected illegal content directly to Germany’s Federal Criminal Police Authority when it is reported. Part of the law was found to violate EU law by a lower court in March 2022, on various grounds, including that it violated the country of origin principle under Article 3 of the e-Commerce Directive.[39]

Third, in Italy, a notable measure was introduced in 2018 targeting online expression that again drew considerable criticism from human rights bodies. This occurred when the Italian Ministry of the Interior implemented an online reporting mechanism for so-called fake news in the run-up to elections (Operational protocol for the Fight Against the Diffusion of Fake News through the Web).[40] The protocol introduced a ‘red button’ reporting mechanism where users could ‘indicate the existence of a network of content attributable to fake news’, and of considerably note was the involvement of the Polizia Postale, a unit of the Italian State Police that investigates cyber-crime, which was tasked with reviewing reports and act accordingly. Notably, the UN Special Rapporteur issued a strongly-word review of the Protocol, noting his concern that the Protocol was ‘incompatible with the standards of international human rights law’, and ‘inconsistent with the criteria of legality, necessity and proportionality’ under Article 19 of the ICCPR, which guarantees freedom of expression.[41] This was because, according to the Special Rapporteur, important terms such as ‘manifestly unfounded and biased news’ were not defined and too vague, while the Italian police would become ‘arbiters of truth in the public and political domain’.[42]

Fourth, in Spain, recent amendments to the Spanish Criminal Code specifically targeting online content have also been subject to considerable critique, including from the Council of Europe’s Commissioner for Human Rights.[43] Notably, Article 578 of the Criminal Code, which criminalises ‘glorification’ and ‘justification’ of terrorism’ and now provides for increased penalties when such content is disseminated online; while a court may order online platforms to remove such content.[44] In this regard, five UN special mandates were highly critical of the ‘vague’ and ‘broad’ notions of ‘glorification’ and ‘justification’ of terrorism, and could allow for the ‘misuse in the oversight and removal of information available online’.[45] Indeed, human rights organisations have documented the law’s application to the removal of music videos from Twitter and the jailing of Spanish rappers,[46] with Amnesty International going so far as to argue that freedom of expression was ‘under attack’ in Spain, where that was now a ‘climate of self-censorship’.[47]

Importantly, the proliferation of laws targeting online expression is not limited to the largest EU member states. For example, Austria recently introduced its Communications Platforms Act 2021, which requires certain online platforms to remove certain illegal content that has been reported ‘no later than 24 hours after receipt of the report’.[48] Further, and as mentioned above, there has been a raft of legislation across EU member states targeting false information and disinformation online. The Commission singled out Hungary for amending Section 337 of the Criminal Code, to include an offence of ‘publishing a statement one knows to be false or with a reckless disregard for its truth or falsity’ during the state of emergency.[49] In this regard, scholars have examined the legislation in a number of other EU member applicable to disinformation. For example, in Lithuania, under Article 19 of the Law on the Provision of Information to the Public, it is prohibited to disseminate disinformation, which is defined as ‘intentionally disseminated false information’. While in Romania, where under a 2020 Presidential Decree, the communications regulator was empowered to order the removal of online content that ‘promotes false news’ in relation to Covid-19.[50] Further, there are wide range of EU member states that criminalise publishing ‘false news’ and ‘information’,[51] which is important to note for the later section which examines the involvement of law enforcement in online monitoring. 

3.2.  Platforms and the proliferation of government surveillance

The previous section sought to demonstrate the proliferation of government measures seeking to restrict expression online across the EU. Crucially, a major consequence of all these new restrictions on online expression, and the leveraging of platform to remove content, is that there had been a related proliferation of government surveillance, monitoring and information-gathering of expression online. Indeed, a whole new array of national and EU agencies are now engaged in monitoring the online environment in some form. For instance, some EU Member States have set up so-called Internet Referral Units (IRUs), which are generally mandated with tasks ranging from the monitoring of specific kinds of online content, to analysing such content or flagging it to platforms so that the latter can moderate it based on their own terms of service.[52] The EU itself has also established such a IRU, which was launched in 2015,[53] within the EU Agency for Law Enforcement Cooperation (Europol).[54]

First, at EU level, public authorities increasingly frame the circulation of online content as a major security concern. For instance, the 2020 EU Security Union Strategy argues that ‘core threats to citizens such as terrorism, extremism or child sexual abuse rely on the digital environment’.[55] The EU perspective is that albeit obligations upon platforms are necessary to secure the online space, companies themselves are also regularly abused by some of their users, that not only engage in activities that are deemed illegal by public authorities, but also disrespect the terms and conditions set up by companies.[56] This discourse prefigures practices in which both public authorities and IT companies are actively engaged in the surveillance of online content. Thus, identifying and quickly removing illegal content would benefit not only European security and protect users, but also preserve the legitimate use of online space.

There are currently multiple European security initiatives in the field of online surveillance. For analytical purposes, we can identify four types of measures. The first kind is of a policy nature and aims at steering IT companies governance with regard to the scope of content moderation. The organisation of the EU Internet Forum, discussed further below, is a primary example of this type of measures, as it creates a venue where platforms and public authorities (including European institutions) regularly meet and discuss joint initiatives. The second type kind of measures is more operational, devising means for public authorities to intervene directly regarding certain categories of online content. A concrete example of these initiatives is the setting up of IRUs and their content moderation activities, whereby these public authorities actively monitor online content, identify and report – that is, flag – specific content to companies for them to remove it following their terms of service. The third type of initiatives concerns legislative instruments that permit public authorities to acquire the capacity to intervene on platforms in a binding way, for example by issuing so-called removal orders. Across Europe, this is the case with the national legislations as discussed above, as well as the adoption of EU regulations such as TERREG and DSA (the latter discussed below).[57] A fourth type of EU initiatives focuses on fostering companies’ capacity in carrying out content moderation in line with European guidelines and regulations. This last strand of initiatives further the idea that public-private cooperation implies also taking into account the actual means (or lack thereof) of both private and public actors, and thus the need to strengthen their technical and operational capabilities, and their capacity to cooperate. For example, the EU Internet Forum has adopted an EU Crisis Protocol in 2019 ‘to respond rapidly and in a coordinated manner to the dissemination of terrorist content online in the event of a terrorist attack,’ involving companies – including the likes of Twitter or Google – as well as public authorities.[58]

All these initiatives highlight the coming into being of what we can call ‘symbiotic’ relations between law enforcement and platforms.[59] Surely, they differ on important aspects from each other, for example concerning the actual mandate behind the action of public authorities, or the nature of the relation between private and public actors (legal, technical, operational or political). However, these measures influence each other, and they are shaping a rather complex landscape of online surveillance in the EU, which requires a continuous attention to ensuring respect of fundamental rights. Besides focusing on policy and legislative measures such as the EU Internet Forum, the TERREG and the DSA, the EU Internet Referral Unit (IRU) deserves particular attention. This is not only the most concrete and operational initiative so far but it is also becoming a pivotal actor in further shaping the overall landscape. Established in late 2015, its mandate is clarified in the Europol Regulation adopted in 2016.[60] The goal of this Unit is to scan the web in search of terrorist propaganda published by groups such as ISIS and Al-Qaida, as well as content related to human smuggling. The scope of its online surveillance has further broadened in 2021, so that it now ‘include[s] [also] right-wing terrorist and violent extremist content online’.[61] Notably, the IRU focuses on online content that is both within Europol mandate and in conflict with the relevant hosting provider’s terms and conditions.[62] In these cases, the IRU refers the online content to the platform – asking for taking it down according to the platform’s own policy – and it stores the same content on a dedicated Europol system – called ‘Check the Web’ – where it will be processed according to Europol rules and thus may be made accessible to EU member states’ law enforcement authorities in the framework of the Europol mandate.[63] As such, IRU operations work at the interface of several practices – the commercial practices of filtering, law enforcement investigation, and supranational cooperation.[64] Furthermore, the IRU is among those public authorities that spearhead public-private partnerships. For example, it engages in cooperation with small and medium companies as well as with major platforms, in the latter case participating in dedicated working groups of the Global Internet Forum to Counter Terrorism (GIFCT), while also providing technical and analytical expertise about, for example, ‘the misuse of algorithmic amplification techniques’.[65]

3.3.  The Digital Services Act (DSA)

Focusing on the DSA allows us to investigate how European Union law can facilitate public and private surveillance practices over content disseminated in online platforms. Despite not being the only EU legislation focusing on content moderation, the DSA deserves our close attention because it provides overarching obligations for digital services that act as intermediaries in their role of connecting consumers with goods, services, and content; it also foresees possibilities for the government to have control over online content. In other words, its scope and potential reach are unique, even compared to legal instruments such as TERREG or national legislations. Thus, we take a closer look at the DSA and we show how it introduces an overarching legal framework to govern some aspects of emerging and existing surveillance practices at the intersection of public-private – platform-government – relations.

Before delving further into the analysis, a brief overview of the DSA is useful for readers not familiar with it. The DSA entered into force in November 2022 and its rules will be applicable directly in all EU Member States for all regulated entities by February 2024.[66] The DSA sets up rules to ensure responsible and diligent behaviour by providers of intermediary services. It aims to create a safer online environment, facilitate the exercise of fundamental rights and attain a high level of consumer protection It cuts through media law, telecommunications regulations, consumer protection, data protection, intellectual property and criminal law but it does not replace sector specific regulation. Briefly put, its provisions range from intermediary liability rules for handling of third party content,[67] a tiered system of due diligence obligations for intermediary services (stricter obligations for platforms with higher number of users), measures on the regulation of content moderation, including through terms of services of platforms and dispute settlement mechanisms for online platforms,[68] systemic risk assessment[69] and independent audit obligations[70] for Very Large Online Platforms (VLOPs) and Very Large Online Search Engines (VLOSEs),[71] to crisis response mechanisms. 

In general, several provisions of the DSA carry the imprints of the aforementioned EU policy and regulatory agenda that considers the moderation of illegal and harmful content as a security concern.[72] The DSA is attractive for governments and law enforcement: it instrumentalises states’ knowledge of allegedly illegal and harmful content[73] and operationalises platform capabilities for crime prevention, security and public safety purposes.[74] Under the DSA, platforms’ ‘responsible and diligent behaviour’[75] is partly defined by their disposition to partner with Member States in their content moderation practices.[76]Although safeguards against abuse of power by platforms and governments are built into the legal framework (e.g. notification to users when their content is removed and dispute settlement mechanisms), concrete measures to mitigate fundamental rights risks are lacking in some instances. The implementation of the DSA is likely to further cement the leveraging of platforms for surveillance and removal of content. This section unpacks these statements by focusing on a number of provisions of the DSA where government influence over online content is most prominent. These are, Article 22 on trusted flaggers, Article 10 on orders to provide information and notification of suspicions of criminal behaviour, and Articles 36 and 48 on crisis response mechanisms and crisis protocols. 

a) Trusted Flaggers

In general, trusted flaggers are specific third parties with expertise on dealing with certain illegal or harmful content that notify such content. Their progression can be connected the notice and take-down regimes endorsed in the intermediary liability rules in the EU (e-Commerce Directive) and the US (the Digital Millennium Copyright Act).[77]

The DSA introduces a regulated ‘trusted flagger’ regime with Article 22,[78] and attaches privileges to this status: the obligation for platforms to ensure that the notices of allegedly illegal content submitted by ‘trusted flaggers’ under Article 16 DSA’s notice and action mechanism are processed and decided upon ‘with priority and without delay’.[79]

The trusted flagger status under the DSA is to be awarded by the Digital Services Coordinators (DSC). And it is available to a ‘limited’[80] number of entities who are ‘independent from any platform’ and ‘have particular expertise and competence in tackling illegal content and work in a diligent, accurate and objective manner’.[81] Entities awarded with ‘trusted flagger’ status by the DSC will be published by the Commission in a publicly available database.[82]

Internet referral units of national law enforcement authorities, Europol, and other semi-public bodies such as organisations ‘committed to notifying illegal racist and xenophobic expressions online’ are among the entities that can be awarded trusted flagger status by the DSC.[83] This means notifications of allegedly illegal content, in the absence of a court order by law enforcement authorities, if awarded trusted flagger status, will have to be dealt with without undue delay as per the notice and action mechanism of Article 16 of the DSA.[84] This can incentivise platforms towards arbitrary treatment of content under opaque conditions, ranging from outright removal to downranking or otherwise,[85] especially given the threat of liability attached to notice and action mechanisms under Article 16, and the lack of a concrete definition of ‘illegal content’.[86] Cooperation between platforms and the law enforcement was recently highlighted in a letter of the European Commission to Alphabet, Inc., which called on YouTube’s provider, Inc., to respond promptly to the requests of Europol and law enforcement authorities given the surge of alleged illegal content and disinformation following the conflict between Hamas and Israel.[87] While the letter pushes platforms to take measures to deal with illegal content and disinformation pursuant to their obligations under the DSA and warns against possible penalties for non-compliance, it does not touch upon censorship risks such measures can entail.

As a form of privatised enforcement of online content, accountability, transparency, and legitimacy concerns and risks to fundamental rights are part of flagging arrangements.[88] Such concerns are further crystallised with the formal recognition of government involvement in flagging under the DSA (e.g. the possibility of Europol or Internet Referral Units getting trusted flagger status). In principle, state intervention on speech is subject to a higher level of constitutional scrutiny,[89] but co-opting platforms by public entities to enforce illegal content bypass constitutional safeguards. In this regard, for example, the Council of Europe’s Committee of Ministers has explicitly stated that ‘State authorities should obtain an order by a judicial authority or other independent administrative authority, whose decisions are subject to judicial review, when demanding intermediaries to restrict access to content’.[90]

Despite the risks of indirect state intervention over online speech in flagging, the DSA does not contain specific measures to address accountability and transparency issues to safeguard freedom of expression and the rule of law.[91] The DSCs’ competencies when awarding the flagger status is limited to reviewing whether an entity fulfils the conditions to be a trusted flagger in consideration of flaggers’ expertise and diligence.[92] The DSA’s intervention to mitigate the risks of state involvement to ensure accountability and transparency in flagging is limited. One mechanism that assists with oversight is the publication of the details of entities awarded with trusted flagger status by the European Commission and the reports on the number of notices submitted and notices categorised platforms, the type of content, and the action taken by platforms.[93] Another one is the possibility to revoke to the trusted flagger status if it submits precise, inaccurate or inadequately substantiated notices.[94] But these provisions do not necessarily address fundamental risks and accountability concerns of flagging. For example, whether a flagger takes measures to safeguard fundamental rights such as to prevent censorship of legal but harmful content when submitting notifications or standards for determining the independence of flaggers (e.g. flaggers’ funding schemes) are not explicitly part of the DSA’s flagger structure. Other provisions of the DSA related to content moderation such as information requirements[95] and dispute settlement mechanisms[96] that would apply to action taken upon notifications submitted by flaggers could assist the scrutiny of state involvement in flagging. But the DSA does not necessarily seek to reveal the conditions of the relationship between governments, including law enforcement authorities, and platforms. Provisions of the DSA do not address how and under what conditions platforms respond to law enforcement requests or how public flagger requests connect to the overall content moderation regimes of platforms – for example, whether content flagged by public authorities is automatically taken down.[97]

One final point on trusted flaggers is that the DSA institutes ‘parallel structures’[98] for flagging – trusted flagger regime does not streamline all flagging practices into a single legal framework. Public-private partnership can still continue outside of the DSA’s trusted flagger scheme, with regard to illegal content, as well as content that is deemed to be ‘harmful’ or that violates platforms’ terms and conditions.[99] As such, platforms continue to be the long arm of the states, which risks circumvention of constitutional safeguards for the protection of fundamental rights, in particular, freedom of expression.[100]

b) Orders to provide information and notification of suspicions of criminal offences 

Another notable provision of the DSA that reinforces public-private partnership in dealing with illegal or harmful content is its provisions that facilitate data gathering from platforms of user information. Article 10 of the DSA allows national judicial authorities and administrative authorities can order online platforms to provide ‘specific items of information’ about a user. Upon receipt of the order, platforms are to inform the issuing-authority ‘without undue delay’ of the effect given to the order.^[101] Article 10(2) provides minimum conditions for orders to be satisfied by authorities to give rise to the obligation for platforms to inform the relevant authorities about the effect given to those orders. The DSA does not provide an obligation to enforce the order itself.^[102]

Are there any safeguards to prevent arbitrary request of user information by national judicial or administrative authorities? Issuing authorities provide to platforms reasons as to why the information is sought to platforms and platforms in turn inform users with statement of reasons and redress opportunities.[103]

But there are exceptions. Article 10(2)(a)(iv) provides that no statement of reasons needs to be given where the reasons relate to the ‘prevention, investigation, detection and prosecution of criminal offence’.[104] The breadth of this exception gives considerable room for authorities to order platforms to provide information and data on users without the need to specify the purpose of the order, beyond that it is needed for investigation of a criminal offence. For example, these orders can relate to contextual and fluid content such as content deemed as insult and defamation and/or publishing false news and false information which are criminal offences in a number of EU member states.[105] In cases of exceptions, without prejudice to other EU and national laws, platforms’ terms of service define how they deal with the procedural aspects of handling with government orders such as how platforms handle government requests for user information and how users are informed of this are defined by (e.g. notification to users and transparency reports).[106] Voluntary procedural efforts concerning government access to user information are worrying as research suggests that voluntary procedural safeguards fall short of safeguarding user information against unjustified intervention on the right to privacy by governments as the terms and conditions of platforms offer lower fundamental rights safeguards and their enforcement significantly varies between platforms.[107]

Further, under Article 18, where a platform becomes aware of information giving rise to a suspicion that a serious criminal offence has taken place, is taking place or is likely to take place, the platform must ‘promptly inform’ national law enforcement of its ‘suspicions’ and ‘provide all relevant information available’. Notably, there is no definition of ‘all relevant information’, and there are no procedural safeguards stipulated under Article 18. Thus, Article 18 basically co-opt platforms into an information-gathering role for law enforcement.

c) Crisis response mechanisms and crisis protocols

Perhaps the most striking examples of measures that enhance public and private surveillance capacities in the DSA are Article 36 on crisis response mechanisms and Article 48 on voluntary crisis protocols.[108] These provisions leverage platforms’ role in dissemination of content in crisis situations for public safety, security and counter-terrorism purposes. Crisis protocols and response mechanisms under DSA are extensions of the EU security policy initiatives,^[109] which rely on private and public cooperation. Among the key priority areas of EU security policy is to tackle evolving treats, such as disinformation, and to prevent and counter the spread of illegal content online such as terrorism, extremism or child sexual abuse.^[110] Crisis protocols are not new to the DSA and they existed as part of the aforementioned EU security policy. For example, the EU Internet Forum adopted the EU Crisis Protocol in 2019 in the context of terrorist or violent extremist content.^[111]

Article 48 on voluntary crisis protocols was in the European Commission’s initial proposal of the DSA and the crisis response mechanism in Article 36 was added during the third trialogue in March 2022.[112] The definition of ‘crisis’ is found in Article 36(2) of the DSA, ‘extraordinary circumstances lead to a serious threat to public security or public health in the Union or in significant parts of it’.[113]

According to these provisions, crisis situations may require certain specific measures to be taken urgently by providers of very large online platforms.[114] VLOPs or VLOSEs decide the substance of the measures to take but the Commission upon a recommendation by the European Board for Digital Services (the Board) can foresee an obligation to take measures, which afford them considerable influence over content moderation processes of platforms. For example, as given in Recital 91, the Commission can issue orders to intensify ‘cooperation with trusted flaggers’ such as law enforcement for removal of content, to a specific point of contact for trusted flaggers during a crisis and to adapt their terms and conditions.[115] The Commission can also order platforms to assess how their functioning and use of their services significantly contribute or are likely to do so to serious threats to public safety or public health.[116] In addition, times of crisis may also permit the Commission to initiate voluntary crisis protocols that can concern online platforms and online search engines in addition to VLOPs and VLOSEs to address crisis situations, ‘strictly limited to extraordinary circumstances affecting public security or public health’.[117]

Against this background, Articles 36 on crisis response mechanisms and 48 on crisis protocols further embed law enforcement and unaccountable public intervention on the online environment during a crisis. The implementation of these provisions can lead to a considerably more aggressive private-public enforcement of rules governing content. Crisis protocols and response mechanisms have been criticised as ‘an overly broad empowerment of the European Commission to unilaterally declare an EU-wide state of emergency’[118] when they were initially proposed by the Commission. This criticism might still hold as situations of crisis, which lack a consistent and clear definition, grant the Commission, an executive body, extensive powers to intervene on fundamental rights in the form of an administrative act.

Fuelled by ensuring safety and security online, Articles 36 and 48 continue to appoint platforms to make judgments on the permissible limits of content on behalf of the states, and bypasses constitutional safeguards for government action. Any restriction to freedom of speech must be proportionate, respect the essence of that right, and meet objectives of general interest to the EU pursuant to Article 52(1) of the EU Charter of Fundamental Rights.[119] Strict obligations to ensure proportionality of measures are lacking, as, for example, the Commission is to ‘aim to’ ensure that the protocol in question sets time limits and defines the specific parameters to define specific extraordinary circumstances when drawing up crisis protocols.[120] It is difficult to imagine how measures taken under Articles 36 and 48 can fulfil necessity and proportionality requirements under the Charter, especially given the broad reach of VLOPs (e.g. the number of users that would be implicated by crisis response mechanisms), that these measures are taken by an executive body in the absence of judicial review and parliamentary control, and the lack of strict and specific restrictions on the Commission’s actions.[121]

Times of crisis may require extraordinary measures to be taken. But the legal framework that allows such measures and their implementation must comply with the principles of the rule of law and observe strict proportionality requirements. Some parallels from the Council of Europe legal regime can be drawn in terms of safeguarding fundamental rights in times of crisis. For example, during Covid-19 Hungary approved provisions criminalized ‘fake news’,[122] which was criticized by the Council of Europe Commissioner for Human Rights as an erosion of media pluralism and freedom of expression in Hungary.[123] Further, the Committee of Ministers of the Council of Europe recommends Member States to avoid using vague terms when imposing restrictions of freedom of expression and information in times of crisis and to clearly define ‘incitement to violence and public disorder’.[124] The ECtHR held that emergency measures should go through democratic review in order to ensure that they are ‘strictly required by the exigencies of the situation’, as laid down in Article 15 of the ECHR, and that they are appropriate responses to the state of emergency.[125] In the context of emergency measures, the ECtHR further highlighted that democracy thrives on freedom of expression and that the existence of a ‘public emergency threatening the life of the nation’ should not serve as an excuse for undue limitations on freedom of expression.[126]

To conclude, our explanations above demonstrate that a number of provisions of the DSA integrate governments into the functioning and operation of private platforms, the conditions of which are not always transparent. The DSA endorses government efforts to detect and tackle illegal activity online, to prevent societal harms and to maintain public order, public health and public safety during times of crisis without strict fundamental rights safeguards against potential abuse. Further, some provisions of the DSA demonstrate the securitisation of platform regulation which exasperates the outstanding proxy censorship concerns. Historically, fundamental rights, including freedom of expression and the right to privacy have been core to establishing the duties and responsibilities of platforms. The shift towards stronger government involvement in online speech enforcement and intensified surveillance on platforms embodied by the EU approach to platform regulation, as also observed in the DSA, are alarming for the protection of fundamental rights online, including the right to freedom of expression and the right to privacy.

4.   Compatibility with human rights 

Having discussed the DSA and TERREG, setting out how European governments are increasingly leveraging platform to restrict expression online, and the consequent proliferation of online surveillance and monitoring of expressive activity, this section examines the European and international human rights concerns. Importantly, these measures, such as monitoring and gathering user content on online platforms, and government-platform initiatives to remove content from online platforms, readily implicate both the right to private life, and the right to freedom of expression, guaranteed under the International Covenant on Civil and Political Rights (ICCPR),^[127] and the European Convention of Human Rights (ECHR).^[128]

4.1.  The right to privacy and government monitoring of online platforms 

The first question that must be posed is whether public authority monitoring of an individual’s public social media content and activity constitutes an interference with the right to private life. Notably, there is considerable literature on mass surveillance methods deployed by intelligence agencies and the compatibility of these measures with human rights law.^[129] However, what we are particularly interested in is the monitoring and gathering of publicly-available information from online platforms, and the content individual posts online by law enforcement agencies, and other national and international authorities. This is a particularly pertinent question, given the range of national and European agencies engaged in these practices, where gathered data and information used to have content removed from platforms, and where there is little oversight or transparency.^[130] In other words, was the Dutch Ministry of Defence correct when stating that its surveillance unit only relied on ‘public information’ online in defence of its actions.^[131]

Importantly, under international human rights law, it is quite clear that government monitoring of publicly-available information about an individual, such posts on online platforms or information shared publicly online, can constitute a serious interference with the right to privacy under Article 17 ICCPR.[132] Indeed, the right to privacy extends to information ‘that is publicly available’, including when government agencies monitor, collect or analyse a person’s online posts.[133] This is because ‘public sharing of information does not render its substance unprotected’.[134] Crucially, this means is that any interference with privacy is only compatible with Article 17 in very limited circumstances, where it is ‘prescribed by law’, ‘strictly and strictly and demonstrably necessary to achieve a legitimate aim’, and ‘proportionate’.[135] necessary. Indeed, the UN Special Rapporteur on privacy has recently criticised the ‘widespread absence of legislation’ on online monitoring.[136]

Similarly, under European law, government monitoring of public expressive activity can constitute an interference with a person’s right to private life under Article 8 ECHR.[137] Importantly, the ECtHR has considered whether the police violate a person’s right to private life when they gather and retain information on a person’s public expressive activity that may not be illegal, but is considered harmful. This question was at issue in the recent Catt v the United Kingdom judgement, where an anti-war activist discovered he was included on a UK police ‘extremism’ database, which documented information gathered by police about his presence at perfectly lawful public protests and demonstrations.[138] Following police refusal to delete the information from the database, the European Court ultimately found a violation of Article 8 ECHR. Crucially, the Court wholly rejected the UK government’s argument that the interference with privacy was ‘very limited’, and unanimously held that it makes no difference that monitoring and gathering of information was not from ‘covert operations’, and the information collected was ‘in the public domain’,[139] holding that the ‘mere storing of information’ amounted to an interference with Article 8 ECHR.[140]

Notably, the Court was particularly scathing of the police gathering of information, holding the police action ‘did not take into account’ the ‘heightened level of protection’ that data ‘revealing a political opinion’ enjoys.[141] Indeed, the Court stated its retention must have had a ‘chilling effect’.[142] Crucially, the Court held that there was no ‘pressing social need’ to retain the activist’s data, and there was an ‘absence of effective safeguards’, which was of ‘particular concern’ to the Court.[143] In a particularly important passage, the Court laid down the fundamental principle that collection of information on individuals ‘solely on the basis that they belong to particular movements or organisations which are not proscribed by law’ should be generally ‘prohibited’.[144]

The Court’s conclusion in Catt is consistent with its earlier judgment in Segerstedt-Wiberg and Others v Sweden, where the Court similarly rejected the Swedish government’s argument that because information gathered on ‘dissidents’ had ‘emanated from open sources’, and ‘public domain’ information, there had been no interference with Article 8 ECHR.[145] While in Shimovolos v Russia, delivered by a unanimous Court in 2021, the Court held that government collection of data and information even ‘exclusively’ on a person’s ‘public activities’ is an interference with the right to private life under Article 8 ECHR.[146]

Indeed, the Court has also delivered numerous judgments on the use of automated systems and data collection systems used for government surveillance. Crucially, the ECtHR has emphasised that surveillance systems using ‘automated and systemic data collection’ had ‘reached a level of sophistication which is hardly conceivable for the average citizen’.[147] Indeed, the Court warned about the capacity of governments to acquire ‘detailed profile[s] of the most intimate aspects of citizens’ lives’, which may result in ‘particularly invasive’ interferences with private life.[148] Similarly, the Court has found a violation of Article 8 over a system allowing storing of a person’s photograph in a police database, where the police could apply facial recognition and facial mapping techniques to the image.[149] The Court emphasised the essential importance of Article 8 to guard against the ‘risk of arbitrariness’ which flows from vesting ‘obscure’ powers with the State, and ‘especially where the technology available is continually becoming more sophisticated’.[150]

IAs such, it is quite clear that this idea of trawling the online environment for harmful content, amassing databases, and sharing this data, raises serious questions under Article 8.[151] Importantly, the Court’s emphasis and concern for protecting political expression from the chilling effect is particularly relevant for the monitoring and gathering of social media content. 

4.2.  Freedom of expression and government leveraging of platforms

The second question is whether the leveraging of platforms for the monitoring of online expressive activity, and the removal of online, under the DSA is compatible with the right to freedom of expression under both international and European human rights law. As noted above, this can take the form of government-platform initiatives, where platforms remove content following referrals from a government or international agency, or non-judicial authorities ordering the removal of content. 

First, under international freedom of expression standards, government measures seeking to leverage platforms for the removal of content are quite suspect. UN human rights bodies, when interpreting Article 19 ICCPR, which guarantees freedom of expression, have been quite clear on the fundamental principle that governments ‘should only seek to restrict content pursuant to an order by an independent and impartial judicial authority, and in accordance with due process and standards of legality, necessity and legitimacy’.[152] Further, governments are required to ‘refrain’ from adopting regulation where ‘government agencies’, rather than ‘judicial authorities’, become the ‘arbiters of lawful expression’, and States should avoid ‘delegating responsibility to companies as adjudicators of content’.[153]

Indeed, and as alluded to earlier, there is considerable concern among UN human rights bodies over the path being taken in Europe in this regard. The UN Special Rapporteur on freedom of expression has warned about how government authorities are ‘increasingly’ seeking to remove online content ‘outside of legal process or even through terms of service requests’, giving the example of specialist EU units, including the Internet Referral Unit, in order to ‘cooperate with platforms to remove’ content.[154]The UN Special Rapporteur has also warned how States put ‘pressure’ on platforms to ‘accelerate content removals through non-binding efforts’, with the Rapporteur criticising that ‘most of which have limited transparency’.[155] There was also criticism of EU governments using trusted flagger mechanisms,[156] with the UN Special Rapporteur criticising how ‘[a]rrangements to coordinate content actions with State input exacerbate concerns that companies perform public functions without the oversight of courts and other accountability mechanisms’.[157] Thus, the proliferation of platform-government initiatives that turn government agencies and law enforcement bodies into arbiters of lawful and unlawful expression are quite questionable under international standards on freedom of expression; and the subsequent delegation of decision about free expression to platforms. 

Similar to the position under international human rights law, it must be noted that European human rights law on freedom of expression also places a considerable question mark over these measures. In this regard, Article 10 ECHR guarantees freedom of expression,[158] and importantly, there has been recent case law from the ECtHR, specifically on online platforms and legislation which allow non-judicial authorities to order the removal of content, and imposing short time-frames for removal of content. Further, the Council of Europe’s Committee of Ministers has explicitly stated that ‘State authorities should obtain an order by a judicial authority or other independent administrative authority, whose decisions are subject to judicial review, when demanding intermediaries to restrict access to content’.[159]

First, one of the most important cases is Kablis v Russia,[160] where the European Court considered Russia’s Information Act, which requires online platforms to remove certain illegal content, including ‘extremist’ content, ‘within twenty-four hours’ by order of an administrative authority. Importantly, the Court unanimously found that a blocking order issued over a post on Russia’s largest social media platform VKontakte (VK) because it was ‘illegal’ content, violated the right to freedom of expression. Crucially, the Court held that the blocking measure was should be classified as a ‘prior restraint’, as it was ‘taken before a judicial decision was issued on the illegality of the published content’.[161] Prior restraints are the most suspect restrictions on free expression under Article 10 ECHR, and as such, the Court applies its highest standard of scrutiny – ‘most careful scrutiny’ – to prior restraints, and consequently, found the order violated Article 10 ECHR. Notably, this was so, even where under the legislation there existed judicial review, with the Court unanimously finding that the legislation lacked the ‘necessary guarantees against abuse’ and to protect against the ‘dangers inherent in prior restraints’.[162] Thus, legislation that allows non-judicial authorities to order platforms to remove content within tight-time frames are classed as prior restraints by the European Court, and subject to the Court’s strict test under Article 10 ECHR.

Second, not only does the European Court apply its strictest standards of scrutiny to fast removal orders by non-judicial administrative authorities, the Court has also found violation of Article 10 where courts make sure orders. Notably, the Court has delivered a number of judgments on a provision in Poland’s election legislation, which allows a court to order prohibit or restrain publication of ‘untrue data or information’, with the court required to examine the application ‘within twenty-four hours’.[163] In its most recent Brzeziński v Poland judgment in 2019, a unanimous European Court found that an order under the provision violated Article 10, which had been issued against a local politician during an election.[164] Crucially, the Court held that the procedure ‘effectively deprived’ the politician of the ‘protection afforded by Article 10’, where the domestic courts had near-immediately classified the information as ‘untrue’.[165] Indeed, it two other judgments on the same provision, the Court also found violation of Article 10. The Court emphasised the ‘very short time-limits’, and in particularly trenchant language, held that the ‘fairness of the proceedings may be called into question’[166] While in Kita v Poland, the Court also unanimously held there had been a violation of Article 10 over the ‘untrue information’ proceedings, finding the national courts ‘unreservedly qualified all of [the statements] as statements which lacked any factual basis’, and the ‘standards applied’ by the national courts were ‘not compatible with the principles embodied in Article 10’.[167]

4.3.  Targeting expression based on broad categorisation of content as illegal

The third issue that must be addressed is that a great deal of government measures leveraging platforms to restrict expression are premised on the assumption that when a piece of content simply falls within a prohibited category of content, it can be removed. And similarly, government surveillance of platforms to root illegal and harmful content is simply a matter of identity content that falls within a certain category of content. However, it is never the case under human rights law that just because shocking, disturbing or offensive expression is labelled ‘terrorist propaganda’, ‘hate speech’, ‘disinformation’, or ‘extremist material’, by law enforcement, public officials, or public prosecutors, that such content is unquestionably illegal, and it is perfectly fine to restrict a person’s free expression. It is always important to bear in mind that human rights courts and bodies, such as the ECtHR, regularly find that national prosecutions and convictions for ‘terrorist propaganda’, ‘hate speech’, and ‘false information’, violate the right to freedom of expression.^[168]

Indeed, when the ECtHR recently found that an activist’s prosecution for incitement to hatred violated the right to freedom of expression, the Court took the opportunity to stress that it is ‘vitally important’ that European governments adopt a ‘cautious approach’, and ‘strictly construe’ incitement laws in order to avoid ‘excessive’ interference with free expression ‘under the guise of action taken against “hate speech”’.[169] Importantly, in the area of alleged ‘terrorist’ content, the Court has similarly displayed great suspicion of near-automatic convictions imposed by national courts for ‘terrorist propaganda’ over publication of statements from proscribed terrorist organisations, and where national courts effectively ignore whether the actual content meets the strict criteria for incitement to violence under freedom of expression law.[170] Crucially, in its unanimous 2018 judgment in Savva Terentyev v Russia,[171] the Court reiterated its strict test under Article 10 for incitement to violence: courts must be satisfied that a) there is a ‘clear and imminent danger’ of violence resulting from the expression; b) the ‘intention’ of the speaker was to incite violence; and c)careful consideration the ‘context’ of the expression.[172] As such, even expression with a ‘violent tone’ can be protected political expression, such as statements that ‘political power grows out of the barrel of the gun’ and ‘it is the barrel of the gun that will call into account’, as Article 10 ECHR has long protected shocking, offensive and disturbing expression.[173]

The foregoing reflects a fundamental and overacting principle of freedom of expression law under Article 10 ECHR: it is never simply the case that because a piece of content falls within a specific legal provision on illegal content that it automatically follows such content can be legitimately restricted consistent with Article 10’s guarantee of free expression. Far from it. The Court has long held that it is ‘not sufficient’ that an interference with free expression is imposed ‘because its subject matter fell within a particular category or was caught by a legal rule formulated in general or absolute terms’.[174] What is strictly ‘required’ under Article 10 ECHR is a ‘detailed judicial assessment’ that the specific interference with free expression was ‘necessary in the specific circumstances’,[175] and applying the strict standard of review under Article 10 ECHR. This is not a fringe principle, and recently reaffirmed by the 17-judge Grand Chamber of the European Court in its seminal Perinçek v Switzerland.[176]

Indeed, in the Kablis judgment, the Court also held that just because content ‘breached a statutory prohibition’,[177] it does not follow that the content can simply be blocked. Instead, it must be determined under Article 10 ECHR whether it was ‘necessary in a democratic society to block the publications at issue, having regard to the facts and circumstances of the case’.[178] The European Court castigated the national courts for failing to engage in this strict standard of review, and the Court held that there had been a violation the right to freedom of expression as the post ‘did not create any real risk of public disorder’ or ‘harmful consequences for public safety’.[179]

There is a danger that the type of government measures currently being implemented and rolled out to tackle supposed illegal and harmful content fundamentally offend the principles of Article 10 ECHR mentioned above. These government measures, whether widespread government monitoring of allegedly illegal and unlawful content, government flagging of such content, and government-platforms cooperation on removal of content, are all based on the assumption that simply identifying a piece of content as allegedly falling within a prohibition contained in a legal provision means that all bets are off, and such content can be requested to be blocked, outright blocked, or the content gathered and stored in databases of harmful content. 

5.   Conclusion

A number of concluding points can be made about the current proliferation of government leveraging of platforms for the purposes of surveillance and removal of content, and the operation of the DSA more generally. First, there are serious concerns under international and human rights law on European and national authorities engaging in monitoring and data-gathering of user content on online platforms. Second, law enforcement involvement in online monitoring and removal of content is at odds with the principle under human rights law that should only seek to restrict content pursuant to an order by a court. Third, there are further serious question marks over non-judicial authorities ordering content to be removed. Fourth, it must be emphasised that European governments need to take the danger of the chilling effect seriously. All these measures are incentivising platforms to removing content rather than risk liability or punishment. And most important, widespread online surveillance is creating an online environment where individuals will refrain from posting important content for fear of government surveillance.

The purpose of this article has not been to argue that the DSA is, per se, a violation of the right to freedom of expression or the right to privacy. However, its central thesis, and contribution to the literature, is that the operationalisation of the DSA by various actors, including the European Commission, national courts, and national Digital Services Coordinators, must be consistent with the rights to freedom of expression and privacy under both international and ECHR case law, in particular the principle of proportionality. This insight further invites literatures on content moderation, digital constitutionalism and the governance of information dissemination to deep dive into the actual implementation of legislation and the field of possibility – especially those for enhance online surveillance – that they open, and this even when legislation aims at ensuring the governance of those actors, like platforms, that currently look like particularly powerful ones.

Finally, a recent worrying controversy involving the European Commission completely reinforces this article’s argument about the need to pay close attention to the implementation of such a far-reaching and comprehensive legislation and its consistency with fundamental rights. In the context of protests and rioting in France during summer 2023, and the French president raising the possibility of ‘blocking social media platforms during civil unrest’, the European Commissioner for the Internal Market, Thierry Breton, made what were described as ‘incendiary statements’, suggesting online platforms could indeed be ‘blocked’ under the DSA for failing to remove ‘hateful content’.[180] Following a particularly strong backlash from free-expression groups, including an open letter signed by 60 civil society groups decrying the Commissioner’s comments, the Commissioner was forced to issue a detailed clarification. The Commissioner explicitly admitted that any measures taken under the DSA needing to be ‘proportionate’, and could only be taken ‘in line with international law and jurisprudence by the European Court of Human Rights’.[181] This episode unfortunately is the danger associated with the DSA, and this article seeks centres the right to freedom of exposit and privacy in its implementation.