EU Parliament's 'More Thoughtful' Approach To Regulating The Internet Still A Complete Disaster

from the regulating-human-behavior dept

For a while now, the EU has been working on its latest big update to internet regulations, mostly under the umbrella of the Digital Services Act (DSA). Multiple people who have been following the process there have noted how much more thoughtful the process has been for the DSA as compared to internet regulatory attempts in the US, which seem to mostly be driven by which senator thinks they can get the biggest headlines for misrepresenting which particular outrage this week. A more careful, thoughtful approach is definitely appreciated, but that doesn't mean the results will be any good. Last week, the EU Parliament approved the latest version of the DSA in what has been seen as something of a mixed bag.

Pirate Party MEP Patrick Breyer described the final vote as having both "huge success and major setbacks." I'm actually a bit surprised that the EFF seems mostly happy with the result (with a few caveats), though that seems to mainly be because a few really bad ideas didn't make the cut. But, it still seems like an awful lot of bad ideas did make it through.

The good parts are that the new DSA mostly retains the E-Commerce Directive's "conditional liability regime" and rejected a proposal that would require "general monitoring" (i.e., faulty filters to try to screen "bad stuff"). There was an attempt to go even further and ban upload filters entirely, but that was rejected. Similarly a proposal to say that courts could not require ISPs engage in full site blocking was rejected.

On the good side, this version of the DSA includes a right to pay for digital services anonymously, though it rejected a limitation on requiring a court order for government's to snoop through your data. It also rejected a proposal that would require a court order to remove content -- banning the practice of enabling government agencies to order content removals. This is extremely unfortunate, and an attack on due process.

There's a lot more in there that's a mix of good and bad, and the whole thing isn't truly final yet either. But, I still think that overall the DSA will have a hugely negative impact on internet freedoms and free speech, even if it got some small things at the margin right.

In the end, I do think that any big "sweeping" set of internet regulations -- whether prepared thoughtfully or not -- are always going to be a disaster. They can't take into account how complex the world is, can't take into account context, and can't take into account the general dynamism of the internet -- and how quickly things change. Not only that, but just the very process of opening up such sweeping regulations that cover so much of how the internet works for users is going to get hijacked by special interests who want this or that thing included in the final regulation.

Is the process more reality-based than the US's grandstand-o-rama? Sure. Will the end results be any better? Doesn't seem like it.

Filed Under: anonymity, conditional liability, data, digital services act, dsa, eu, filters, intermediary liability, internet regulations, privacy

Why The EU Needs To Get Audits For Tech Companies Right

from the it's-too-easy-to-get-it-wrong dept

Discussions over the right – or at least a good – way to regulate big tech companies are heating up in the European Union (EU). Several legislative proposals are set to be negotiated, with public and behind-the-scenes lobbying in full swing already. As with any regulation, a key question is how to hold corporate decisionmakers accountable for their actions and how to create transparency. Some of the ways this has typically been done in other industries include legally mandated corporate compliance regimes, rules for financial or supply chain transparency and mandatory risk assessments and audits. These ideas are coming to the tech sector now, too, especially with the draft “Digital Services Act” (DSA). The DSA suggests new due diligence rules for platforms such as Facebook and YouTube, for example, regarding what processes are in place for content moderation and how they deal with potential infringements on users’ fundamental rights. Audits are introduced to check whether companies comply with the DSA’s due diligence rules.

If done right, audits can be a valuable mechanism helping independent researchers, oversight bodies and the public hold tech companies accountable. If done poorly, audits will be mere check-the-box exercises with little value that might even hurt people and entrench platform power. That is why it will be crucial for the EU get the audit provisions in the DSA right. Four major issues, drawn from past experiences with audits and general risks associated with them, need to be taken into account.

First, there is the risk of a weak auditor or an auditor with only limited powers. Facebook’s and Google’s “privacy audits” in the US can be taken as an example. Each company was subjected to legally mandated scrutiny by the US Federal Trade Commission over data protection issues. Yet, what were at times billed as “privacy audits” turned out to be mere assessments that were later criticized as almost meaningless due to vague language and powers for the regulator.

Second, auditors can, conversely, be too powerful. If their mandate is ill-fitting or too broad, the auditing company or governmental agency that oversees global corporate giants like Facebook and Google might have quite a sway in what billions of people access, read and watch on the web. This could be abused for financial or political interests. Especially authoritarian leaders might try to tip the scale in their favors by controlling big tech companies, which has some lawmakers in the EU worried as well.

Third, the auditing process itself can lack clear guidance and oversight. Without quality control, what is meant to be a safety measure and to incentivize corporate compliance can turn into a check-the-box exercise. Unfortunately, there are grave examples for this danger: “Social audits”, aiming to certify suitable workplace conditions, especially in the clothing industry, have come under intense scrutiny, after audited companies’ factories burned or crumbled, killing hundreds of workers. A for-profit auditing system with little checks can be partly to blame. In the financial industry, bad and sometimes illegal business practices could not be stopped despite auditing regimes being in place, as the WireCard case in Germany illustrates. Similarly, the international “Dieselgate” scandal showed the limitations of overseeing car manufacturers.

Relatedly, fourth, audits need to have consequences if they reveal corporate malfeasance. An audit that shows how a company failed to follow the rules cannot only result in recommendations or a blow to the company’s reputation. Fines and, more importantly, changes in business practices and compliance processes are necessary.

In all four areas, the DSA needs improvement. To address the first two points on the strength or weakness of the auditor, it is crucial that the auditor’s tasks and powers are clearly delineated. For tech companies offering people news and information spaces, a top priority should be that auditors check corporate processes, not individual pieces of content. This means that the auditor should, for instance, monitor whether companies have suitable notice-and-action mechanisms, meaningful reporting standards about their online advertising practices and recommender systems as well as consumer protection measures in place. Determining the legality of content should be left neither to corporations nor governmental regulators, but to independent courts. This would ensure that platforms are held accountable, without establishing an all-powerful auditor. The DSA draft goes in this direction, but the tasks of the auditor need to be spelled out in greater detail.

In practical terms, it is not yet clear who could and should do the auditing. Looking towards established audits in other industries can be helpful but copying existing methods risks perpetuating its flaws (like with the social audits) and not accounting for the peculiarities of tech companies. It is presumptuous to assume that big accounting firms might just take on auditing tech companies. Auditing a company like Facebook, TikTok or Snapchat is not the same as auditing a bank or an insurer. Auditors need different skills and specific technical knowledge in this field, which many existing auditing outfits might not have yet. However, it is also ill-advised to blindly rely on young companies now claiming to audit tech companies or even “algorithms”, as there is no common definition of what such “algorithmic auditing” entails. For example, the Ada Lovelace Institute, a UK-based NGO, has identified four different ways to assess algorithmic systems and those can, in turn, contain different approaches. An industry has sprung up offering to audit algorithmic systems for biases and legal compliance but there are no standards for such audits or auditors. To ensure high-quality auditors and a system of checks and balances, the EU should define what audits are supposed to achieve and what is expected of auditors. A vetting process regarding the financial independence of platforms and auditors could be discussed, as well as guidelines for oversight and quality control. Otherwise, audits risk being a fig leaf for tech companies or, worse, a cover-up for systemic failures like with some “social audits”.

Lastly, the DSA’s remedies for failed audits and non-compliance need to be beefed up. An independent oversight entity should be enabled to stop abusive business practices and sanction companies. Promisingly, this idea on enforcement as well as some potential improvements to the auditing regime have been put forth by the European Parliament. With the DSA, the EU has the chance to build an auditing regime for digital platforms from scratch. It should strive to make it as structurally sound as possible to limit terrible outcomes like those described above. This is not far-fetched, because some platforms’ business practices have been linked to genocide, election interference and invasions of privacy, just to name a few risks.

Establishing clear rules for the content of audits, standards for the auditors themselves and consequences for tech companies would be a true EU innovation. It would ensure a watch-the-watchers approach for auditors and thus alleviate legitimate concerns that governmental or private auditors (especially if paid for by the platforms) undermine democratic oversight. Taken together, this would go a long way in improving accountability for tech companies.

Julian Jaursch is a project director working on platform regulation topics at Stiftung Neue Verantwortung (SNV), a Berlin-based not-for-profit, non-partisan tech policy think tank.

Filed Under: audits, content moderation, digital services act, dsa, eu, tech policy

Driven Mad By Its Hatred For Big US Internet Companies, French Government Implements EU Digital Services Act Before It Even Exists

from the to-hell-with-the-consequences dept

The future Digital Services Act (DSA), dealing with intermediary liability in the EU, is likely to be one of the region's most important new laws for the online world. At the moment, the DSA exists only as a proposal from the European Commission. In due course, the European Parliament and the EU's Member States will come up with their own texts, and the three versions will ultimately be reconciled to produce legislation that will apply across the whole of the EU. As Techdirt reported last month, the Commission's ideas are something of a mess, and the hope has to be that the text will improve as the various arms of the EU start to work on it over the coming months.

The French government, however, is unwilling to wait before it can start imposing intermediary liability on the US Internet giants it seems to hate so much. It has decided to bring in key parts of the DSA immediately -- even though it doesn't formally exist -- using what it calls a "pretranscription" of the proposed EU law. Next Inpact has the details (original in French), but what matters most is the way the "pretranscription" of the DSA clashes with an important existing EU law, the e-Commerce Directive. The European Commission explains:

While the e-Commerce Directive remains the cornerstone of digital regulation, much has changed since its adoption 20 years ago. The DSA will address these changes and the challenges that have come with them, particularly in relation to online intermediaries.

The DSA is intended to update and supersede the e-Commerce Directive. But until the DSA is passed -- something that is years off -- the e-Commerce Directive remains in force, and is incompatible with France's local pretranscription. The best the politicians in France can come up with to justify this extraordinary course of action, which cuts across how the EU is supposed to work collectively to draw up laws that apply uniformly across the whole region, is that all-purpose excuse -- the threat of terrorist attacks. Even the French Senate's Law Committee warned of the "extreme legal fragility" of the government's logic here. In reality, it's just another case of the French government keen to bash Internet companies as soon as it can, and to hell with the political, economic or social consequences.

Follow me @glynmoody on Twitter, Diaspora, or Mastodon.

Filed Under: digital services act, dsa, eu, france, internet regulation

Is The Digital Services Act Going To Make A Huge Mess Of Website Liability In The EU?

from the sounds-like-it dept

I've been so focused of late on issues related to Section 230 in the US, that I've had barely any time to devote to the Digital Services Act in the EU, which is the EU's ongoing efforts to rewrite intermediary law in the EU. The reports I have followed have been a mix of concerns, with the admission that it at least appeared that EU politicians were trying to get a good grasp on the issues and trade-offs and not rush in with a totally horrible plan. That doesn't mean the end result is good, but so far it does not appear to be totally disconnected from reality, as with many similar proposals we've seen around the globe.

Joan Barata has a good report looking at the the current state of intermediary liability in the latest DSA proposal and notes that it's... kind of a mess. Basically, as is often the case with intermediary liability laws, very few policymakers have experience with the actual issues, and thus they can't take into account how various provisions will actually work in practice. Frequently that means that proposals are worded vaguely, and no one will really know what they mean until after a series of lengthy, confusing, and expensive court decisions.

As Barata notes, the DSA appears to retain the basic liability protections that have existed for the last two decades in the EU in the form of the E-commerce Directive (which is weaker than Section 230's protections in the US, but are roughly equivalent in saying that websites should not be held liable for 3rd party content). The big difference with the E-commerce Directive is that websites do need to remove content "upon obtaining actual knowledge or awareness" of "illegal activities." Of course, what exactly is meant by "obtaining actual knowledge or awareness" becomes a tricky question at times and did involve some lawsuits.

The DSA, though, moves the liability situation further away from Section 230 and more to a DMCA style "safe harbor" situation, by establishing that knowledge can be obtained through "notices":

Apart from the provisions included in Article 5, Article 14(3) establishes that notice and action mechanisms fulfilling certain criteria give rise to actual knowledge or awareness.

The DSA tries to avoid the classic "moderator's dilemma" issue by saying that even though knowledge or awareness could make you liable, you don't necessarily lose your liability protections if you carry out your own investigations:

Article 6 clarifies that intermediaries may not lose their liability protections “solely because they carry out voluntary own initiative investigations or other activities aimed at detecting, identifying and removing, or disabling of access to, illegal content, or take the necessary measures to comply with the requirements of Union law, including those set out in this Regulation”.

But what does that mean in practice? You can lose the protections if you know about illegal stuff on your website, but you don't lose them if you are doing your own investigation. But at what point does finding stuff during your own investigation magically morph into knowledge or awareness? Well, the answer seems... contradictory. Basically, it sounds like the current draft of the DSA hangs an awful lot of weight on the word "solely." If illegal content is discovered "solely" via an investigation, then a site might retain its protections -- but if that same content is discovered in any other way, then the site may have knowledge and face liability. This... is going to be confusing.

And, again, this tends to be the problem with all of these proposals. They want to encourage sites to moderate to clean up bad stuff, but if they mandate liability for having knowledge of bad stuff, you incentivize less searching. But now you are still left in a weird, twisted position, where you say "okay, you can search, but if you find stuff, you're no longer liable for it... unless you also have separate knowledge of it." And how do you manage that?

This is actually one of the many reasons why -- despite all the criticism it receives -- Section 230 gets the balance right. It gives websites a free hand in moderating content, but does so in a way that many, many other forces come into play in pressuring the company to be a good actor in the space. Public pressure, user concerns, media coverage, and advertiser pressure, all serve to push websites to improve their moderation practices. Too many people, however, think that without a law mandating such things, nothing happens. That's wrong. We're seeing every website continually work to create better policies not because of the risk of some confusing and potentially very costly law, but because they don't want their site to be a dumpster fire of awful.

Filed Under: confusion, digital services act, dsa, e-commerce directive, eu, intermediary liability, knowledge, monitoring, notices, section 230

As EU Starts To Draft Its Most Important New Online Law, The Digital Services Act, MEPs Want Basic Rights High On The Agenda

from the but-massive-lobbying-and-dirty-tricks-will-soon-fix-that dept

The EU is now starting to work in earnest on what is likely to be its most important new law for the online world, the Digital Services Act (DSA). Techdirt wrote about this last year, when the European Commission started sketching out (bad) ideas for the new law. The basic impetus for the DSA is to replace the EU's e-Commerce Directive, which was passed 20 years ago, and is clearly in need of an update. As the European Commission's page on the DSA explains, there are two core elements:

First, the Commission would propose clear rules framing the responsibilities of digital services to address the risks faced by their users and to protect their rights. The legal obligations would ensure a modern system of cooperation for the supervision of platforms and guarantee effective enforcement.

Second, the Digital Services Act package would propose ex ante rules covering large online platforms acting as gatekeepers, which now set the rules of the game for their users and their competitors. The initiative should ensure that those platforms behave fairly and can be challenged by new entrants and existing competitors, so that consumers have the widest choice and the Single Market remains competitive and open to innovations.

Those aims mean that the DSA touches on several of the most contentious issues in the online world, such as the introduction of mandatory pan-European rules for tackling online hate speech and disinformation, and efforts to control platforms that are "gatekeepers" -- basically US companies like Google and Facebook. In other words, the DSA is going to be important, and not just for the EU. One of the key players in the drafting of the DSA is the European Parliament. The good news is that in a series of votes MEPs have made clear that they want protection for key human rights to be an integral part of the new law.

The votes concerned reports from three of the Parliament's specialist committees: those for the Internal Market and Consumer Protection, Legal Affairs, and Civil Liberties (pdf). The three reports are couched in a rather impenetrable EU-speak; fortunately, the European Parliament has put out a press release on the votes that provides a more comprehensible summary of the three reports. The European Parliament is quite open about what the EU hopes to achieve with the DSA: "With the upcoming package, the European Union aims to shape the digital economy at EU level as well as setting the standards for the rest of the world, as it did with data protection." One of the priorities of the DSA is tackling illegal content online. On this, MEPs say:

A binding "notice-and-action" mechanism must be set up so that users can notify online intermediaries about potentially illegal online content or activities. This would help online intermediaries to react quickly and be more transparent regarding the actions they have taken on potentially illegal content. Users should be able to seek redress through a national dispute settlement body.

The European Parliament wants a distinction made between illegal content and harmful content, with a legal liability only for the former. MEPs say that there should be no general monitoring of users, and that platforms should not use upload filters for controlling harmful or illegal content: "The final decision on whether content is legal or not should instead be taken by an independent judiciary and not by private undertakings". It's hard to square that with the awful Article 17 of the EU Copyright Directive, which inevitably requires precisely this kind of upload filter to block allegedly infringing content. MEPs say that harmful content should be dealt with through "enhanced transparency obligations and by helping citizens to acquire media and digital literacy regarding the dissemination of such content." According to the European Parliament, another priority of the DSA should be enhancing consumer protection and user safety:

Platforms and online intermediation services will need to get better at detecting and taking down false claims and tackling rogue traders, e.g. those selling false medical equipment or dangerous products online, as happened during the COVID-19 outbreak.

MEPs also call for a new "Know Your Business Customer" principle to be introduced, requiring platforms to check and stop fraudulent companies using their services to sell their illegal and unsafe products and content.

More controversial is a call for rules to prevent -- not merely remedy -- what MEPs called "market failures by big platforms". The stated aim is to open up markets to new entrants. Some of the most striking ideas to emerge from the reports are: to allow online users to opt out of content curation, to be informed if a service is enabled by AI, and to ban microtargeted advertising:

Targeted advertising must be regulated more strictly in favour of less intrusive, contextualised forms of advertising that require less data and do not depend on previous user interaction with content. MEPs also call on the Commission to further assess options for regulating targeted advertising, including a phase-out leading to a ban.

As Techdirt has noted, such targeted advertising doesn't really seem to bring much in the way of benefit to advertisers, but certainly causes people to be tracked relentlessly, and huge amounts of personal information to be gathered. Getting rid of it in the EU could encourage companies to re-think their advertising strategies globally, just as the GDPR has had a big knock-on effect on data protection everywhere. That would be welcome, as would a move to enshrine in the DSA a right to use digital services anonymously "whenever possible". Adding a right to strong encryption without backdoors would be even better: at the moment, one report simply "Stresses the importance to apply effective end-to-end encryption to data".

Two of the reports approved by the European Parliament are what are known as "legislative initiatives" (PDF). Although not binding on the European Commission, such initiatives require a much fuller response if any of the proposed ideas are rejected. This gives the European Parliament's ideas more chance of making it into the final text of the DSA. Against that, some of the most powerful companies in the world will be deeply affected by the EU's new law, which guarantees years of fierce lobbying and dirty tricks, as the dispiriting experience of the Copyright Directive demonstrated.

Follow me @glynmoody on Twitter, Diaspora, or Mastodon.

Filed Under: digital services act, dsa, e-commerce directive, eu, eu parliament, harmful content, illegal content, intermediary liability, online harms, tracking