Digital Services Act – information-sharing system

KEY POINTS

The regulation:

• establishes the information-sharing system, AGORA;
• regulates the responsibilities of the Commission, the digital services coordinators, the board, AGORA administrators² and AGORA actors³ in connection with AGORA;
• regulates the processing of personal data and joint controllership in AGORA;
• regulates the access rights to AGORA, along with confidentiality obligations, security measures, translation, monitoring and reporting, and cost.

Setting up AGORA

• The Commission is responsible for establishing and maintaining a reliable and secure information-sharing system, AGORA, that can also be used for the exchange of personal data, where necessary.
• AGORA ensures the exchange of information among digital services coordinators, the Commission and the board, along with other competent authorities granted access to it, in relation to the supervision, investigation, enforcement and monitoring of compliance under the DSA.
• AGORA supports various operations, including case-handling activities, one-to-one exchanges of information, notification procedures, alert mechanisms, mutual assistance procedures and problem solving, ensuring a prompt and effective response to emerging risks in digital services, particularly those concerning illegal content, disinformation and systemic risks posed to fundamental rights, public security and democracy.
• AGORA is available in all official EU languages and integrates automated tools for translating documents and messages exchanged on AGORA, ensuring inclusivity across Member States.

Responsibilities

• The Commission is responsible for:
  • various tasks related to the set-up, operation, reliability, security, availability, maintenance, development and performance of AGORA, including providing training, support and knowledge to AGORA administrators and AGORA users⁴;
  • appointing at least one AGORA administrator;
  • registering AGORA administrators on behalf of the digital services coordinator and the board, and granting them access to AGORA;
  • performing processing operations on personal data in AGORA; and
  • auditing, monitoring and preparing reports.
• Digital services coordinators are responsible for:
  • appointing at least one AGORA administrator per Member State;
  • ensuring that only authorised AGORA users have access to AGORA;
  • informing the Commission of the AGORA administrator appointed;
  • ensuring that the AGORA administrator appointed fulfils their responsibilities; and
  • performing processing operations on personal data in AGORA.
• The board is responsible for:
  • appointing one AGORA administrator;
  • ensuring that only authorised AGORA users have access to AGORA; and
  • informing the Commission of the identity of its AGORA administrator and the tasks for which they are responsible.
• AGORA administrators are responsible for:
  • registering AGORA users and granting and revoking access to them in AGORA;
  • acting as the main point of contact for the Commission for issues relating to AGORA;
  • providing knowledge, training and support to the AGORA users appointed by them; and
  • ensuring the efficient provision of adequate responses by AGORA actors.
• AGORA actors are responsible for:
  • granting and revoking access rights to AGORA administrators for whom they are responsible; and
  • putting in place appropriate means to ensure that AGORA administrators and AGORA users are allowed to access personal data processed in AGORA only where strictly necessary for the supervision, investigation, enforcement and monitoring of compliance under the DSA.

Data protection and security

• Any exchange of information in AGORA, which may include personal data, must be in compliance with the rules on the protection of personal data laid down in Regulations (EU) 2016/679 and 2018/1725.
• Personal data exchanged in AGORA must be processed only as necessary and proportionate for the supervision, investigation, enforcement and monitoring of compliance under the DSA.
• Data subjects can exercise their rights in accordance with Regulations (EU) 2016/679 and 2018/1725.
• Joint controllership in AGORA is provided for in connection with certain operations.
• The Commission must put in place the necessary, state-of-the-art measures to ensure the security of personal data processed in AGORA, including in the event of a security incident, take remedial action and ensure that it is possible to verify what personal data have been processed in AGORA, when, by whom and for what purpose.

Monitoring and reporting

• The Commission regularly monitors and evaluates AGORA’s functioning and performance, and submits a report every three years to the European Parliament, the Council of the European Union and the European Data Protection Supervisor.
• The digital services coordinators, the board and other competent authorities provide the Commission with any relevant information for the report.

Costs

• The costs incurred for AGORA are covered by the annual supervisory fees collected by the Commission in accordance with Article 43(2) of Regulation (EU) 2022/2065 and Commission Delegated Regulation (EU) 2023/1127.
• The costs for operations in AGORA at the Member State level are to be borne by the Member State that incurs them.