In a responsible and mature economy, businesses should not be able to operate and have access to the modern necessary infrastructure Europe has to offer without accurately identifying themselves. This applies equally to the offline and to the online world, which is why in 2000 legislation introduced an obligation on businesses to identify themselves on their websites (see Article 5 of the e-Commerce Directive (ECD)). Unfortunately (and unsurprisingly) businesses that have the intention of making a profit out of illegal content do not comply with this obligation and do not suffer consequences.
This letter focuses on the “Know Your Business Customer” (KYBC) obligations of the proposal, the signatories of this letter may also be in touch with you independently on this and other important elements of the DSA.
Limiting KYBC obligations to the context of online marketplaces is a missed opportunity to address the broad range of illegal content and counterfeit, unsafe, non-compliant and substandard products online.
As the European Parliament stresses (see amendment 512, recital 39b (new)), the DSA represents a real opportunity to rectify a situation that allows bad actors to ignore Article 5 of the ECD with impunity. A business cannot go online without a domain name, without being hosted, or without advertisement or payment services. Intermediary service providers, having a direct relationship with the business, are therefore best placed to make sure that only businesses that are willing to comply with the law have access to their services.
This does not mean monitoring their business customers’ behaviour, but merely asking them to identify themselves and applying simple due diligence checks on the basis of publicly available data. Should the information provided prove to be manifestly wrong, or the intermediary be notified that the business customer isn’t who it claims to be, the intermediary service provider should stop providing services until the business customer remedies the situation.
For decades, fraudulent businesses have been exploiting the lack of enforcement of the information requirements under Article 5 of the ECD, which has been to the detriment of a safe and trustworthy online environment and has facilitated the use of online infrastructure by completely anonymous commercial entities that intentionally make available or distribute illegal content and products. These include operators of scam websites and operators of online services distributing illegal content, including but not limited to, substandard or falsified medicines, sexual abuse material, counterfeits, malware, illegal gambling, piracy and more. These illegal activities can cause serious harm to EU citizens’ physical, psychological and financial wellbeing. In some cases, especially during the COVID-19 pandemic, they can even pose a threat to life.
The Digital Services Act is an opportunity for the European co-legislators to address these shortcomings of the ECD. Many Member States have indicated their support for Italy and Spain’s Joint Statement calling for broad KYBC provisions to be addressed during the interinstitutional negotiations. The European Parliament has also demonstrated majority support for a broad KYBC provision (see also corrected RCV on amendment 514). We urge you to ensure that all intermediary service providers – not just online marketplaces – know who their business customers really are.