Caught in the middle: EDPB finalises guidance on the interplay between the DSA and GDPR

The European Data Protection Board (EDPB) adopted its final Guidelines on the interplay between the Digital Services Act (DSA) and the EU General Data Protection Regulation (GDPR) in September. The Guidelines address an increasingly familiar feature of the EU's digital regulatory landscape: the same activity may be caught by multiple regimes. 

The DSA, which came fully into force in February 2024 (see our previous blog), applies alongside the GDPR, so organisations subject to the DSA must comply with both regimes even in respect of the same activity.

The Guidelines aim to promote consistent application of the GDPR where both regimes apply, covering areas including content moderation, notice and action mechanisms, deceptive design, advertising, recommender systems, the protection of minors and systemic risk assessments. We highlight key points below.

Content moderation – balancing of interests

The EDPB considers that legitimate interests is likely to be the most appropriate lawful basis for voluntary investigation of illegal content. However, platforms must consider whether individuals would reasonably expect the scope of the processing and take “all necessary steps” to inform them of the specific legitimate interest pursued. It is unclear whether a privacy notice is sufficient.

When assessing the impact on individuals as part of the legitimate interests balancing test, the EDPB says that platforms should reflect that lawful information which is incompatible with their terms and conditions may be less harmful than illegal content.

Age assurance: importance of proportionality

Platforms should avoid age-assurance methods that enable the unambiguous online identification of users and should not permanently retain the age or age range produced by an age-estimation process. GDPR compliance therefore requires the least intrusive method that meets the required purpose. In most cases this will be age estimation rather than age verification. However, if adopted, the EU KIDS Act proposals will significantly change age-assurance requirements for in-scope services by bringing in more concrete rules (see our earlier blog).

When is it automated decision making?

The EDPB highlights that some processing designed to comply with the DSA may amount to automated decision making (ADM). Beyond the standard test of a lack of “meaningful human involvement”, it will be ADM “if the human draws strongly” on algorithmic recommendations, echoing the less-cited CJEU case of OQ v Land Hessen (2023).

The EDPB welcomes that the DSA separately requires information to be provided when content is removed, whether or not the decision amounts to ADM.

Special category data: a harder line for advertising

The DSA prohibits online platforms from presenting advertisements based on profiling using special category data (SCD) as defined in the GDPR. The EDPB explains that this also captures data derived or inferred through profiling, or that indirectly reveals SCD.

This goes beyond the GDPR’s profiling rules and could significantly affect behavioural advertising. The prohibition applies even where ad targeting and serving are outsourced to third-party ad tech providers, but platforms may struggle to ensure compliance given their limited visibility of how those providers build audience segments. 

The Guidelines also reiterate the CJEU’s Russmedia judgment that a platform provider may be a joint controller of personal data in adverts on its interface in certain circumstances, and that the DSA’s prohibition on general monitoring obligations does not displace its GDPR obligations. Compliance is likely to require greater transparency, contractual safeguards, due diligence and ongoing oversight.

The EDPB also highlights that DSA and GDPR transparency requirements diverge:

• DSA information must be provided in real time and be directly accessible from the advert, whilst GDPR information can sit in the privacy notice one click away; and 
• DSA information is presented after the processing of personal data has occurred, whilst the GDPR requires it at the time of data collection from the individual.

Compliance measures will therefore also need to differ.

Deceptive design: supremacy of the GDPR

The EDPB states that, where platforms offer a choice of recommender systems, the GDPR requires that users are not nudged towards a profiling-based option. The DSA’s prohibition on deceptive design patterns expressly does not apply to practices covered by the GDPR (or the Unfair Commercial Practices Directive), so such nudging is assessed under the GDPR. DSA competent authorities can still enforce the DSA’s separate recommender system obligations, including the requirement for VLOPs and VLOSEs to offer at least one option not based on profiling.

Two regimes, one compliance exercise?

The Guidelines reinforce a broader direction of travel in EU digital regulation: compliance with one part of the EU's digital rulebook increasingly requires an understanding of the others.

For providers subject to the DSA, GDPR compliance should therefore not sit downstream of decisions about content moderation, recommender systems or advertising. The data protection implications need to be considered in the design of those systems themselves.

For businesses operating across both regimes, the question is no longer just ‘Can we process this data under the GDPR?’ but also ‘What does the rest of the EU digital rulebook allow us to do with it?’