Home PublicationsCommentary How Including the “Know Your Business Customer” Requirement in the DSA Could Help Address Some of the Web’s Biggest Problems

How Including the “Know Your Business Customer” Requirement in the DSA Could Help Address Some of the Web’s Biggest Problems

by Eline Chivot
Margrethe Vestager, EU Commission Vice President for a Europe fit for the digital age

How much should Internet platforms know about the businesses that use their services? One proposal on the table for the Digital Services Act (DSA), an update to the EU’s nearly two-decade-old eCommerce Directive, is to require platforms implement a “know your business customer” (KYBC) policy to prevent bad actors from operating under a cloak of anonymity. The idea, which has gained support from the Commission’s top executives and some representatives from various industries, ranging from media publishers and advertisers to pharmaceutical companies and the sporting goods industry, presents an opportunity to improve online services for businesses and consumers, if properly implemented.

The KYBC principle would obligate online intermediaries to collect identification information from their commercial business users to verify their identity. The goal is to stop bad actors from using legitimate services to engage in illegal activity, such as selling unlawful or unsafe goods and services. These rules would only apply to business-to-business relationships, so they would exclude consumers.

There are many bad actors online who should rightfully fear such a provision because it would make it much easier to take legal action against them. For example, law enforcement would be able to more easily identify who is behind sites distributing child sexual abuse material and malware, or sites involved in illegal gambling operations or online scams. Similarly, businesses would be able to more easily take civil action against those sites or vendors involved in selling counterfeit or pirated goods, including items such as food or drugs that can pose safety hazards to consumers, while also harming the brands of the companies they impersonate.

A recent survey of 1,000 business users across four EU member states found that 44 percent of business users surveyed expect that KYBC provisions in the DSA could improve consumers’ trust in their business integrity and decrease competition from fake accounts. Many Internet services already use systems to verify the identity of their business customers, and platforms have ramped up efforts to fight fraud and counterfeiting in recent years, investing significant financial and human resources to protect consumers from abuse, fraud, and harm.

Counterfeiting in particular is a growing threat for the European economy, its businesses, and consumers. Counterfeits lead to a sales loss of 7.4 percent on average across the EU within intellectual property-intensive industries, which amounts to direct lost sales of 56 billion euros per year and the loss of almost 468,000 jobs. According to a 2019 study by the OECD and the EU Intellectual Property Office (EUIPO), these products made up 6.8 percent of European imports in 2016. A 2019 EUIPO report adds that 97 percent of all counterfeits identified on the European Commission’s rapid alert system for dangerous non-food products (RAPEX) database were found to pose a serious risk to health and safety, while consumers increasingly and often unknowingly buy them. For example, counterfeit toys, which are the most common product type reported as counterfeit and dangerous, pose a chemical hazard to children.

The European Commission should ensure KYBC obligations are proportionate and specific in scope: The requirements should be limited to the direct commercial relationships of those intermediaries for which it is feasible to efficiently apply this system. Verification requirements should impose minimal burden and delays on platforms and business users. Indeed, not all online intermediaries engage in contractual relations with those businesses using their platforms, such as search engines, and therefore cannot readily verify the identity of their business users. Finally, while KYBC requirements would make Internet platforms responsible for knowing the identity of their business customers, the DSA should not make platforms liable for the content of their users, nor should it translate into an obligation to monitor business users’ behavior.

The DSA has created an opportunity for the EU to consider new strategies for improving the online environment, protecting consumers from various risks, and enhancing the competitiveness of online businesses, and a carefully implemented KYBC requirement could help achieve these goals.

Image credits: Wikimedia Commons.

You may also like

Show Buttons
Hide Buttons