Digital Services Act (DSA) | Data Protection Ombudsman’s Office

The obligations imposed by the Digital Services Act (DSA) apply to all online services, referred to as 'intermediary services' in the DSA. Intermediary services include

conduit services (e.g. wireless local area networks and internet exchange points);
caching services (e.g. provision of content delivery networks); and
hosting services (e.g. cloud computing, web hosting services, search engines, content delivery sites, social networks, online marketplaces, application stores, accommodation and travel booking sites, and other online platforms).

The DSA imposes obligations on intermediary services according to the type and size of service. To be able to appropriately comply with the DSA's requirements, every online service provider must define the intermediary services offered by it.

The obligations for online platforms do not apply to small enterprises and microenterprises. Commission Recommendation 2003/361/EC defines microenterprises and small enterprises as enterprises which employ fewer than 50 persons and have an annual turnover not exceeding EUR 10 million.

In Finland, the supervision of compliance with the DSA has been split between Traficom, the Office of the Data Protection Ombudsman and the Consumer Ombudsman.

The Data Protection Ombudsman supervises the identifiability of political and societal advertising on online platforms, the transparency of online advertising and recommender systems, and the protection of minors on online platforms. These obligations are provided for in Articles 26–28 of the DSA.

In Finland, compliance with the DSA is mainly supervised by the Finnish Transport and Communications Agency (Traficom). For example, Traficom supervises the obligations related to notification channels for illegal content.

The Consumer Ombudsman supervises companies' advertising targeted at consumers, the identifiability of commercial advertising and the identifiability of traders in online marketplaces. The Consumer Ombudsman also supervises that online platforms are not designed in misleading or manipulative ways.

Very large online platforms and search engines are supervised by the European Commission.

If the content or advertising shown to users of online platforms is based on the recommending of content, they must be clearly informed of this. The user must be informed of how the recommender systems impact the way content or advertising is displayed to them. Users must also be informed of how they can influence how content or advertising is displayed to them.

The online platform's terms of use must state the recommender systems' main criteria and variables on which the recommending of content to users is based. The terms of use must also indicate whether these parameters can be changed and how the user can influence them.

If advertising is shown on the online platform, users must be informed of the parameters used for advertising and whether they can change these parameters. This information must be presented directly in connection with the advertisements shown.

In its terms of use, the online platform provider must give at least the following information on the parameters used in its recommender systems:

the main criteria and variables used to recommend content to users; and
the relative importance of the parameters for showing content.

If an online platform (e.g. website or application) recommends content to users based on more than one parameter, the platform must have a functionality with which users can change the logic by which the recommended content is ranked. This functionality must be easily useable on the online platform, directly in the section where content is recommended to the user.

The DSA requires online platforms to guarantee the privacy and safety of minors. Protection of minors must be taken into account already in the design stage of online platforms. Ways of taking minors into account in online platform design include default privacy settings, limiting the access of minors to harmful content, or offering parental control tools to custodians.

You can notify the service provider, such as the online platform, directly of the content or problem you have noticed. Service providers are obliged to offer a channel that anyone can use to easily report illegal content or content in violation of the terms of use that they notice in the service.

Service users also have the right to be informed of the decision made by the service provider due to the report. Such decisions should be open to redress. The service provider must have an effective and free internal complaint processing system for this purpose.

The authorities oversee the lawfulness of the service provider's practices. In the event of an issue, the user can file a complaint with the authorities after attempting to clear the matter up with the service provider.

First notify the service provider, such as the administrator of the online platform, directly of the problem you have noticed.

The Office of the Data Protection Ombudsman supervises service providers' obligations with regard to the identifiability of societal and political advertising, transparency of recommender systems and protection of minors on the web. You can contact the Data Protection Ombudsman if advertising is being targeted by making use of sensitive personal data or the personal data of a minor, if there are problems in the identifiability of political advertising, or if the online platform provider is not ensuring the privacy and safety of children in its service.

You can contact the Consumer Obmudsman in matters involving advertising targeted at consumers and the identifiability of commercial advertising.

Frequently asked questions about the Digital Services Act (DSA)

What kinds of operators are subject to the DSA's obligations?

Does the DSA apply to online services offered by municipalities or authorities?

Does the DSA apply to non-commercial advertising on the company's or organisation's own website?

What powers does the Office of the Data Protection Ombudsman have to enforce the DSA?

How must online platforms inform users of the recommending of content and advertising?

Are online platforms obliged to provide the opportunity to change the parameters of their recommender systems?

Do the obligations concerning the transparency of recommender systems also apply to online platforms subject to a fee, or only to free services open to all users?

Do the DSA's obligations apply to social media content that includes advertising?

How are online platforms required to ensure the privacy of minors?

What can I do if I encounter illegal content or content that violates the terms of use on an online platform?

In what kinds of matters can I contact the Office of the Data Protection Ombudsman?