Chapter 4|Competent Authorities and National Digital Services Coordinators|📖 18 min read
1. Member States shall lay down the rules on penalties applicable to infringements of this Regulation by providers of intermediary services under their jurisdiction and shall take all measures necessary to ensure that they are implemented. The penalties provided for shall be effective, proportionate and dissuasive.
2. Member States shall, without undue delay, notify the Commission of those rules and of those measures and shall notify it, without undue delay, of any subsequent amendment affecting them.
3. Member States shall ensure that the maximum amount of fines that may be imposed for a failure to comply with an obligation laid down in this Regulation shall be 6 % of the annual worldwide turnover of the provider of intermediary services concerned in the preceding financial year. Member States shall ensure that the maximum fine that may be imposed for the supply of incorrect, incomplete or misleading information, failure to reply or rectify incorrect, incomplete or misleading information and failure to submit to an inspection shall be 1 % of the annual income or worldwide turnover of the provider of intermediary services or other persons referred to in Article 51(1) in the preceding financial year.
4. Member States shall ensure that the maximum amount of a periodic penalty payment shall be 5 % of the average daily worldwide turnover or income of the provider of intermediary services concerned in the preceding financial year per day, calculated from the date specified in the decision concerned.
Understanding This Article
Article 52 establishes the penalty framework for DSA enforcement at the national level, setting maximum fine caps and requiring Member States to ensure penalties are 'effective, proportionate and dissuasive.' This provision mirrors GDPR Article 83's penalty structure while adapting to digital services' unique characteristics. The three-tier penalty framework—6% of global turnover for substantive DSA violations, 1% for procedural violations (incorrect information, inspection refusal), and 5% of average daily turnover for ongoing non-compliance through periodic penalty payments—creates powerful enforcement mechanisms enabling DSCs to impose fines comparable to largest GDPR penalties. The 'effective, proportionate and dissuasive' standard, derived from EU competition law and administrative penalty jurisprudence, requires penalties actually achieve compliance (effectiveness), match violation severity (proportionality), and deter future violations by this provider and others (dissuasiveness).
Member State Penalty Frameworks (Paragraph 1): Member States must 'lay down the rules on penalties applicable to infringements of this Regulation' and 'take all measures necessary to ensure that they are implemented.' This grants Member States discretion in implementing national penalty frameworks within Article 52's maximum caps, enabling adaptation to national legal traditions while ensuring minimum deterrence. National implementation involves: (1) Substantive penalty rules - defining which DSA violations trigger which penalties, criteria for calculating fine amounts within maximum caps, factors for assessing proportionality, rules for cumulative penalties (multiple simultaneous violations). (2) Procedural rules - process for imposing fines (investigation, right to be heard, decision, judicial review), allocation of penalty authority (DSC directly or judicial authority on DSC request), payment terms and enforcement mechanisms, appeals procedures. (3) Implementation measures - budgetary provisions for DSC penalty collection, administrative infrastructure for fine imposition, enforcement cooperation with tax authorities or bailiffs for collection, transparency mechanisms (publishing penalty decisions).
The 'effective, proportionate and dissuasive' requirement creates three constraints on Member State discretion: (1) Effectiveness - penalties must actually achieve DSA compliance, not be merely symbolic. Ineffective penalties fail Article 52: de minimis fines platforms can easily absorb without changing behavior, penalties rarely imposed due to procedural obstacles, inadequate enforcement infrastructure preventing collection. Member States can't implement penalty frameworks that systematically undermine DSA enforcement through low fine levels or impractical procedures. (2) Proportionality - penalties must match violation severity. Disproportionate penalties violate Article 52: identical fines for vastly different violations (minor technical lapse vs. systematic rights violations), penalties disregarding provider circumstances (crushing fines for SMEs unable to comply vs. large platforms deliberately non-compliant), failure to account for mitigating/aggravating factors. (3) Dissuasiveness - penalties must deter violations by this provider and others. Non-dissuasive penalties fail Article 52: fines so low they're cost-of-doing-business for large platforms, penalties not publicly disclosed (reducing general deterrence as other providers unaware), inconsistent enforcement creating perception violations go unpunished.
Recital 117 elaborates: 'Member States should establish rules on penalties for infringements of this Regulation in respect of providers of intermediary services under their jurisdiction. Violations of this Regulation should be sanctioned in an effective, proportionate and dissuasive manner, taking into account the nature, gravity, recurrence and duration of the violation in view of the public interest pursued, the scope and kind of activities carried out, as well as the economic capacity of the infringer. Member States should also take into account, where appropriate, whether the provider of intermediary services systematically or recurrently fails to comply with its obligations under this Regulation and the number of service recipients actually or potentially affected by the infringement.' This establishes specific factors DSCs must consider in calculating penalties.
Notification to Commission (Paragraph 2): Member States must 'without undue delay, notify the Commission of those rules and of those measures' and notify 'any subsequent amendment affecting them.' This ensures Commission oversight of national penalty frameworks enabling: (1) Legal compatibility review - Commission verifies national rules comply with Article 52 requirements (within maximum caps, embody effective/proportionate/dissuasive standard, include appropriate procedural safeguards), potentially initiating infringement proceedings if Member State rules inadequate. (2) Cross-border consistency - Commission can identify problematic divergences in national penalty frameworks potentially creating regulatory arbitrage or competitive distortions, may issue guidance or recommendations promoting convergence. (3) Public transparency - Commission publication of national penalty frameworks enables: providers to understand penalties in different Member States, civil society to assess national enforcement stringency, academic researchers to study comparative penalty frameworks, cross-border enforcement coordination as DSCs understand each other's penalty regimes. (4) Evolution tracking - 'any subsequent amendment' notification requirement ensures Commission remains informed of penalty framework changes potentially responding to enforcement experience, judicial decisions, or changing circumstances.
Maximum Fine Caps (Paragraph 3): Paragraph 3 establishes two maximum fine levels: (1) General violations: 6% of annual worldwide turnover for 'failure to comply with an obligation laid down in this Regulation.' Covers all substantive DSA violations: Article 11-15 obligations (points of contact, terms, transparency reporting), Article 16 notice-and-action mechanism failures, Articles 19-28 platform obligations (complaints, trusted flaggers, minor protection, advertising transparency, recommender systems), Article 30 marketplace trader verification, Articles 34-43 VLOP/VLOSE obligations (risk assessments, audits, transparency, crisis protocols). 6% cap mirrors GDPR Article 83(5) maximum for most serious violations (data processing principle violations, rights infringements), reflecting DSA violations' comparable seriousness to privacy violations. (2) Procedural violations: 1% of annual income or worldwide turnover for: 'supply of incorrect, incomplete or misleading information' - providing false data in response to Article 51(1)(a) information requests, 'failure to reply or rectify incorrect, incomplete or misleading information' - ignoring information requests or declining to correct false information when notified, 'failure to submit to an inspection' - refusing Article 51(1)(b) premises inspections or obstructing investigators. These procedural penalties apply to both 'provider of intermediary services or other persons referred to in Article 51(1)' - meaning third parties (auditors, business partners) subject to information requests can face 1% penalties for non-cooperation.
Turnover calculation issues: 'Annual worldwide turnover' means global revenue from all business activities, not just EU operations or digital services specifically covered by DSA. For diversified conglomerates, entire corporate group turnover may apply if group operates as single economic entity for competition law purposes. 'In the preceding financial year' means most recently completed fiscal year at time of violation or decision (practices vary). Multi-year violations may use turnover from year most representative of violation period. Calculation challenges for: platforms with rapid revenue growth (preceding year turnover may significantly understate current capacity to pay), platforms losing money (no turnover cap but penalties based on revenue potential), subsidiaries of larger groups (whether parent company turnover applies depends on whether subsidiary autonomous or parent directs operations).
Periodic Penalty Payments (Paragraph 4): 'Maximum amount of a periodic penalty payment shall be 5% of the average daily worldwide turnover or income of the provider of intermediary services concerned in the preceding financial year per day, calculated from the date specified in the decision concerned.' Periodic penalties are forward-looking daily fines accumulating until compliance, distinct from backward-looking fines for past violations. Calculation: (1) Average daily turnover = annual worldwide turnover ÷ 365 days. (2) Maximum daily penalty = 5% of average daily turnover. Example: Platform with €10 billion annual turnover has average daily turnover of ~€27.4 million; maximum periodic penalty = €1.37 million per day. (3) Accrual period = from date specified in DSC decision (typically deadline for compliance) until compliance achieved. If DSC orders compliance within 60 days and platform fails, periodic penalties accrue from day 61 onwards. (4) Total penalty = daily penalty × number of days non-compliant.
Periodic penalties create escalating pressure: Day 1-30: €41 million accumulated; Day 31-60: €82 million total; Day 61-90: €123 million; Day 91-180: €246 million; Day 181-365: €500 million. At maximum daily rate (5%), even large platforms face crushing penalties if non-compliance extends months. This forces compliance: rational economic actors cannot absorb unlimited daily penalties indefinitely; mounting penalties create urgency for management action; periodic penalties directly address business calculation that fines for past violations might be acceptable cost-of-doing-business. Periodic penalties cease upon compliance; paid penalties don't erase but become sunk costs incentivizing prompt remediation.
Interaction with Article 51(2)(d): Article 51(2)(d) grants DSCs power to 'impose a periodic penalty payment...in accordance with Article 52 to ensure that an infringement is terminated in compliance with an order issued pursuant to point (b) of this subparagraph or for failure to comply with any of the investigative orders issued pursuant to paragraph 1.' Article 52(4) provides the maximum cap (5% daily). Together they create complete framework: DSC issues cessation order with compliance deadline, if provider fails to comply, DSC imposes periodic penalties up to Article 52(4) maximum accruing daily until compliance.
Key Points
Member States must establish penalty rules that are effective, proportionate and dissuasive
Maximum fine for DSA violations: 6% of annual worldwide turnover
Maximum fine for information violations/inspection refusal: 1% of annual turnover
Maximum periodic penalty payment: 5% of average daily turnover per day
Penalties must consider: nature, gravity, recurrence, duration of violation
Economic capacity of provider considered in proportionality assessment
Systematic or recurrent failures warrant higher penalties
Member States must notify Commission of penalty rules without undue delay
Penalties apply to all intermediary services regardless of size
Proportionality crucial - SME penalties must differ from tech giant penalties
Periodic penalties accumulate daily until compliance achieved
Comparable to GDPR Article 83 but with 6% cap vs GDPR's 4%
Cumulative penalties possible for multiple distinct violations
Cooperation and self-remediation are mitigating factors
Fine collection through national procedures with cross-border enforcement
Practical Application
Penalty Calculation Example - Major Social Media Platform: German BNetzA investigates major social media platform (hypothetically €50 billion annual turnover) for systematic Article 16 notice-and-action violations: inadequate Turkish-language moderation, excessively narrow terrorist content policies, 95% of terrorist content notices ignored. Investigation (Article 51(1)) establishes violations occurred over 18 months. BNetzA calculates proportionate fine under Article 52:
(1) Maximum cap: 6% of €50 billion = €3 billion maximum fine. (2) Proportionality assessment factors (Recital 117): Nature - Article 16 notice-and-action is core DSA obligation protecting users from illegal content exposure; violations directly harm public safety by leaving terrorist content accessible. Category: High severity. Gravity - systematic failure affecting hundreds of thousands of illegal content notices over 18 months, including terrorist content posing life/safety threats. Not isolated incidents but deliberate policy choices resulting in widespread non-compliance. Category: Very serious. Recurrence - ongoing systematic pattern, not one-time mistake. Platform repeatedly failed to act on notices despite clear legal obligations. Category: Aggravating factor. Duration - 18 months from first identified violations to investigation completion. Prolonged non-compliance despite BNetzA warnings. Category: Aggravating factor. Public interest - combating terrorism, protecting users from exposure to radicalizing content, maintaining platform accountability for content moderation obligations. Category: Highest public interest. Economic capacity - €50 billion turnover demonstrates substantial capacity to comply; violations not result of resource constraints but policy decisions. Category: No mitigating factor. Systematic/recurrent failure - violations stem from inadequate policies and resource allocation, not isolated errors. Platform capable of compliance but chose not to adequately invest. Category: Aggravating factor.
(3) Calculation: BNetzA determines violations merit fine of 1.5% of annual turnover = €750 million. Rationale: Violations very serious (systematic failure on core obligation affecting public safety), significantly below maximum (6%) reflecting absence of worst aggravating factors (platform cooperated with investigation, implemented some improvements during proceedings, no evidence of deliberate attempt to violate DSA), sufficient to deter future violations by this platform and others (€750M exceeds profit from Turkish market, sends message that non-compliance economically irrational). (4) Comparison alternatives: Too low (€50 million = 0.1%): Platform could view as cost-of-doing-business; insufficient deterrence given violation severity and turnover scale. Proportionate middle (€750 million = 1.5%): Reflects serious systematic violations while recognizing partial mitigation; significant enough to ensure compliance but not existentially threatening. Too high (€2.5 billion = 5%): Approaching maximum for violations that, while serious, don't represent worst DSA breaches (no evidence of deliberately facilitating terrorism, platform responded to some notices, improvements underway); would be disproportionate absent more extreme aggravating factors.
Periodic Penalty Calculation - Ongoing Non-Compliance: Building on above example, assume platform contests €750M fine but also fails to implement required remedial measures (hire Turkish moderators, revise policies). BNetzA issues Article 51(2)(b) cessation order requiring full compliance within 90 days. Platform misses deadline. BNetzA imposes periodic penalties under Article 52(4):
(1) Daily turnover calculation: €50 billion annual ÷ 365 = €137 million average daily. (2) Maximum daily penalty: 5% of €137 million = €6.85 million per day. (3) BNetzA assessment: Given violation severity and platform's financial capacity, impose €3 million per day (below maximum showing proportionality but substantial enough to force action). (4) Accrual: Day 1 (day 91): €3 million; Day 30: €90 million; Day 60: €180 million; Day 90: €270 million; Day 120: €360 million. (5) Platform response: After 35 days and €105 million in accumulated periodic penalties, platform's board intervenes, approves emergency budget for compliance, implements required measures. BNetzA verifies compliance, stops periodic penalties at €105 million accrued. Total penalties: €750M fine (under judicial review) + €105M periodic penalties = €855M. Message: Non-compliance is economically unsustainable; mounting daily penalties forced action where static fine alone might not have.
Procedural Violation Penalties - Obstruction of Investigation: Austrian DSC investigates mid-sized platform (€200 million annual turnover) for suspected Article 30 marketplace violations. Platform response to Article 51(1)(a) information requests demonstrates: initial response omitted 60% of requested trader verification data, follow-up clarification still incomplete and contained demonstrably false statistics, platform repeatedly delayed providing full information over 9 months. DSC considers this 'supply of incorrect, incomplete or misleading information' under Article 52(3) second sentence:
(1) Maximum cap: 1% of €200 million = €2 million. (2) Assessment: Violations serious - platform's obstruction delayed investigation 9 months, false information misled DSC requiring extensive verification, incomplete data prevented full assessment of Article 30 compliance. However, violations procedural not substantive (investigation ultimately succeeded despite obstruction). (3) Fine imposed: €800,000 (0.4% of turnover). Reflects: serious obstruction warranting substantial penalty, but below maximum given procedural nature and eventual cooperation, sends message that investigation obstruction severely punished but not at levels of substantive DSA violations. (4) Separate substantive fine: If investigation confirms Article 30 violations, platform faces additional fine up to 6% for those violations. Total penalties could reach: €800k procedural + up to €12M substantive = significant combined impact.
Small Platform Proportionality - Micro-Enterprise: Lithuanian DSC finds local forum (3 employees, €150,000 annual turnover) violated Article 15 transparency reporting and Article 11 point of contact requirements. Technical violations—forum operator unaware of obligations, immediately remediated upon notification. DSC penalty decision:
(1) Maximum cap: 6% of €150,000 = €9,000. (2) Proportionality assessment: Nature - procedural violations (missing reports/contact), not substantive harms. Gravity - minor; no evidence of user harm, good faith lack of awareness. Duration - 6 months before DSC notice. Recurrence - first offense. Economic capacity - micro-enterprise; €9k fine would be ~6% of annual revenue, severe burden. Mitigating factors - immediate compliance upon notice, good faith, lack of prior violations. (3) Penalty imposed: €500 administrative fine + warning. Rationale: Violations must be penalized (even SMEs must comply), but proportionality requires considering economic capacity and good faith; €500 sufficient to ensure attention to compliance without crushing micro-enterprise; warning puts on notice that future violations face higher penalties. (4) Comparison: Disproportionate: €9k maximum would exceed quarterly revenue, potentially forcing closure for good-faith technical violation. Proportionate: €500 meaningful enough to matter but not devastating; combined with warning creates compliance incentive without destruction. Too lenient: €0 would suggest obligations don't apply to small platforms, undermining DSA.
GDPR Comparison - Cross-Regulatory Penalty Analysis: Article 52's structure closely parallels GDPR Article 83 but with differences: (1) Maximum caps: GDPR - 4% or €20M (whichever higher) for some violations, 2% or €10M for others. DSA - 6% (no alternative floor) for substantive violations, 1% for procedural. DSA's 6% higher than GDPR's 4%, reflecting platforms' often larger revenue bases and need for strong deterrence. (2) Periodic penalties: GDPR - periodic penalties via Article 58(2)(j) but no specific cap in Article 83; Member State law determines. DSA - explicit 5% daily cap in Article 52(4) harmonizing periodic penalty levels EU-wide. (3) Factors: Both require effectiveness, proportionality, dissuasiveness. GDPR Article 83(2) lists detailed factors (intentional vs. negligent, mitigation, prior violations, cooperation, affected data subjects, technical/organizational measures). Recital 117 of DSA mirrors these. (4) In practice: Largest GDPR fines to date (2024): Amazon €746M (2021), Meta €1.2B (2023), Meta €390M (2022). Potential DSA fines: Similar or higher given 6% cap and some platforms' huge turnovers. Major VLOP violations could exceed largest GDPR fines.
National Implementation Examples - Divergent Approaches: (1) Germany - Digital Services Act Implementation Law (TTDSG + amendments): Implements Article 52 granting BNetzA power to impose fines directly (no judicial authority requirement). Detailed calculation methodology published in BNetzA guidelines considering: baseline fine based on violation category, multipliers for aggravating/mitigating factors, transparency in decision publication (anonymized until appeals exhausted). Approach: Administrative efficiency (DSC acts directly), transparent methodology, precedent-building through published decisions. (2) France - DSA transposition into French law: ARCOM can impose certain penalties directly but must request tribunal for fines exceeding €250,000. Judicial involvement for larger penalties ensures fundamental rights protection and judicial expertise in proportionality. Approach: Balances administrative efficiency (ARCOM decides smaller fines) with judicial oversight (court determines major penalties). (3) Ireland - Coimisiún na Meán structure: DSC can impose administrative sanctions up to specified thresholds; larger fines require High Court application. Court assesses proportionality, provider defenses, fundamental rights implications. Approach: Judicial heavy model reflecting Irish constitutional traditions protecting property rights (fines implicate property).
Cumulative Penalties - Multiple Simultaneous Violations: Platform simultaneously violates: Article 15 (transparency reporting), Article 16 (notice-and-action), Article 20 (internal complaints), Article 27 (recommender transparency). Can DSC impose separate fines for each? Legal analysis: (1) Article 52 silent on cumulation. (2) EU law principles: ne bis in idem (double jeopardy) prevents punishing twice for same conduct. But separate violations of different obligations aren't same conduct. (3) Likely approach: DSC can impose separate fines for distinct violations but total must respect proportionality. If violations interconnected (e.g., transparency failures across multiple articles), DSC might impose single fine considering all violations together. If truly separate (Article 16 content moderation failures + unrelated Article 30 trader verification failures), separate fines possible. (4) Practical example: Platform A violates only Article 16: fine €500M. Platform B violates Articles 15, 16, 20, 27 stemming from systematic transparency/accountability failures: probably single fine €700M (higher than Platform A reflecting multiple violations but not 4× separate fines which would be disproportionate for related failures). Platform C violates Article 16 (content moderation) + Article 30 (trader verification) + Article 43 (data access for researchers) in completely unrelated contexts: potentially separate fines up to €500M + €300M + €200M = €1B total, if proportionate to distinct violation patterns.
Fine Collection and Enforcement: (1) Payment terms: DSC decisions typically give 30-90 days to pay fine, extendable if provider demonstrates financial hardship requiring installment plan. (2) Non-payment consequences: Interest accrual on unpaid fines, enforcement through national debt collection procedures (bailiff seizure, asset attachment), in extreme cases criminal prosecution for fine evasion (if national law provides). (3) Cross-border collection: Fines imposed by one Member State's DSC on provider established in another Member State use EU mutual recognition of administrative decisions for collection across borders. German BNetzA fine on Irish-established platform can be enforced in Ireland through administrative cooperation. (4) Insolvency scenarios: If provider enters bankruptcy, DSA fines treated as administrative debts in insolvency proceedings. Questions of priority vs. secured creditors, employee claims, tax debts depend on national insolvency law. (5) Appeals and suspension: Judicial appeals of fines typically don't automatically suspend payment obligation (provider must apply for suspension demonstrating irreparable harm from payment during appeal). Courts may require payment into escrow pending appeal outcome.
For Platforms - Penalty Risk Management: (1) Compliance investment ROI: Platforms should calculate: cost of full DSA compliance (systems, staff, processes) vs. expected value of penalties (probability of violation × potential fine amount). For VLOPs with billions in turnover, compliance costing tens of millions is rational if it reduces probability of €500M-1B fines. (2) Violation assessment: Internal legal teams should continuously assess DSA compliance across obligations, flagging areas of non-compliance for prioritized remediation. Periodic internal audits (supplementing Article 37 external audits for VLOPs) identify issues before DSC investigations. (3) Investigation cooperation: During DSC investigations, cooperation may reduce penalties (Recital 117 considers cooperation as mitigating factor). Stonewalling investigations triggers procedural fines (Article 52(3)) and aggravates substantive penalties. Balance: cooperate with lawful requests while preserving legal challenges to disputed interpretations. (4) Early remediation: Upon discovering violations, voluntarily remediate before DSC investigation may reduce penalties (shows good faith, limits violation duration, reduces harm). Some Member States' penalty frameworks include 'self-reporting' discounts where providers proactively disclose violations. (5) Financial reserves: Platforms operating in regulatory uncertainty should maintain financial reserves or insurance for potential DSA fines, particularly VLOPs facing multi-billion potential penalties.
For Civil Society and Enforcement Monitoring: (1) Penalty publication: Monitor DSC publication of penalty decisions (required by many Member States for transparency). Analyze whether penalties proportionate to violations, identify patterns of over/under-enforcement. (2) Comparative analysis: Compare penalties across Member States for similar violations revealing disparate enforcement. If German DSC fines €10M for Article 16 violations while another DSC fines €100k for comparable violations, raises questions about consistency. (3) Deterrence assessment: Track whether penalties actually deter violations. If platforms repeatedly violate same obligations despite fines, suggests penalties insufficient (not dissuasive). If violations decrease post-penalty, confirms deterrence. (4) Advocacy for adequate penalties: Where DSCs impose inadequate penalties failing effectiveness/dissuasiveness standard, civil society should: publicly criticize weak enforcement, file complaints with Commission about inadequate national penalty frameworks, engage in policy advocacy for stronger national implementation, support affected users in judicial challenges if penalties too low to remedy harms. (5) Celebration of strong enforcement: When DSCs impose appropriately strong penalties, civil society should publicly support, countering platform narratives of excessive regulation, demonstrating public backing for robust enforcement, encouraging other DSCs to follow precedent.