EU Digital Markets Act Enters Into Force on November 1, Creating New Regulatory Regime for Large Tech Platforms | Skadden, Arps, Slate, Meagher & Flom LLP

The European Union’s Digital Markets Act (DMA) was published in the Official Journal of the EU on October 12, 2022. The legislation, which regulates major technology platforms, will come into effect on November 1, 2022 (20 days after publication) and the notification and review will come into force six months later, on November 1, 2022.

From that date, companies that meet the financial and user thresholds that result in a presumption of gatekeeper status have two months to report this and submit any submissions as to why gatekeeper status is not warranted (a counter-notice). The EC must decide on gatekeeper status within 45 working days of receiving a company’s submission, and designated gatekeeper companies must comply with applicable DMA obligations within six months of the EC’s designation decision.

The European Commission will shortly launch a public consultation on the DMA Implementing Regulation, which will include a draft form for market gatekeeper designation and other procedural rules. EU Competition Commissioner Margrethe Vestager has also suggested that the European Commission organize workshops to gather user, consumer and third party views on DMA compliance by major platforms.

gatekeeper designation

The DMA establishes rules that define and prohibit perceived unfair commercial practices by major online platforms, which are seen as key gatekeepers between European businesses and consumers. The law applies in parallel with EU and national competition rules.

Unless a company provides substantiated arguments to the contrary, a company is deemed to have gatekeeper status and fall within the scope of the DMA if it meets the following three criteria:

1. It provides a core platform service that serves as a key gateway for business users to reach end users. “Core Platform Service” includes the following: online intermediary services, online search engines, online social networking services, video sharing platform services, number-independent human communication services, operating systems, web browsers, virtual assistants, cloud computing services, and online advertising services (including all advertising networks, advertising exchanges and other advertising intermediation services).
2. It has significant implications for the EU internal market. The company has generated annual sales of at least €7.5 billion within the last three financial years or an average market valuation of at least €75 billion in the past financial year within the EU and offers at least the same core platform service to three member states.
3. It enjoys an (established or anticipated) established and permanent position. The company has an average of at least 45 million end-users per month established or resident in the EU and at least 10,000 business users per year established in the EU in each of the previous three financial years.

The DMA requires companies to self-assess whether they meet the gatekeeper criteria and notify the EC of their status within two months of meeting those thresholds. The DMA requires gatekeeper companies to comply with a number of duties and prohibitions within six months of being designated as a gatekeeper.

prohibitions

The DMA prohibits gatekeeper companies from:

• Processing of end-user personal data collected by third-party services to provide online advertising services without prior consent (Art. 5 (2) (a));
• reuse of personal data collected during one service for purposes of another service without prior consent (Art. 5 (2)(b)-(c));
• prevent business users from offering their products and services at different prices and conditions on their own sales sites as well as on third-party platforms (ie., broad and narrow parity clauses) (Art. 5 (3));
• Prevent users from filing complaints with authorities (Art. 5 (6));
• require users to use certain platform services (eg., payment systems, identification services, web browser engines or technical services) (Art. 5 (7));
• require users to register/subscribe to other core platform services as a condition of using any of the core platform services (Art. 5 (8));
• Use of business users’ non-public data to compete against them (Art. 6(2));
• rate their own products or services higher than those of others (Article 6(5));
• Restricting end users from switching between different apps and services (Article 6(6)); and
• establishing disproportionate termination conditions for business users; (Art. 6 para. 13)

obligations

The DMA requires gatekeeper companies to:

• Enable communication and access to content between business users and end-users (Art. 5(4)(5));
• Guaranteeing price and fee transparency for advertising mediation services (Art. 5(9)-(10));
• ensure that users can access their marketing or advertising performance data on the platform (Art. 6(8));
• allow end users to easily change default settings and/or uninstall software apps on an operating system (OS), unless this is necessary for the proper functioning of the operating system (Art. 6(3));
• allow the installation and use of third-party apps or app stores that do not compromise the integrity of the device or operating system (Art. 6(4));
• enable effective interoperability with operating systems, hardware or software applications (Art. 6(7));
• Ensuring the interoperability of the basic functions of instant messaging services with those of other platforms (Article 7);
• Ensuring the portability of end-user data to other systems or applications (Article 6(9));
• to grant commercial users real-time access to their data generated on the platform (Art. 6 para. 10);
• to provide other online search engines with fair, reasonable and non-discriminatory (FRAND) access to ranking, query, click and view data generated by end-users on its online search engines (Art. 6(11));
• application of FRAND access terms for business users to its software app stores, online search engines and online social networking services (Article 6(12)); and
• to notify the European Commission of all acquisitions affecting core platform services, data collection or the digital sector, regardless of whether they are subject to notification to the European Commission under the EU Merger Regulation (Article 14).

The Commission will have the power, at its discretion, to update the list of obligations and prohibitions through “delegated acts” (ie., supplementary legal acts from the DMA), for reasons of fairness or to remove obstacles to competition.

Companies must also annually submit to the EK, within six months of their designation as gatekeepers, and publish in summary form an independently verified description of all consumer profiling techniques that the gatekeepers employ on or through their core platform services.

Additional compliance obligations include: designating a compliance monitoring role within the organization; annual reporting and publication of the steps taken by the gatekeeper to comply with the code of conduct; and a commitment by management to review compliance at least annually.

Enforcement and Sanctions

The EC will be the sole enforcer of the DMA, working closely with authorities in EU Member States, who will be able to initiate national investigations and provide evidence to the EC to consider enforcement actions. In addition, the EC can impose penalties and fines of up to 10% of a company’s annual worldwide turnover and up to 20% of that turnover for repeated infringements.

In the case of systematic rule violations (ie., at least three breaches in eight years), the EC may also impose behavioral or structural remedies on a company to ensure the effectiveness of the DMA’s obligations, including a ban on acquisitions relevant to the breach. Gatekeepers may also face class action lawsuits from individuals and companies in national courts for failure to comply with DMA obligations.

The DMA applies in parallel with EU and national competition rules.

key data