Data Access and Scrutiny Mechanisms under DSA

Data Access and Scrutiny Mechanisms under DSA

Legal Framework

The DSA establishes a multi-tiered data access and scrutiny regime principally governed by Article 40, supported by Recitals 96, 97, and 98. The provision creates three distinct access channels: (1) access for the Digital Services Coordinator (DSC) of establishment or the Commission for compliance monitoring; (2) access for vetted researchers for systemic risk research; and (3) access to publicly available data for researchers more broadly.

Under Article 40(1), VLOPs and VLOSEs face a mandatory obligation to supply data upon reasoned request from their DSC of establishment or the Commission. The scope is broad—covering data necessary to assess compliance with the entire Regulation—and Article 40(3) extends this to explanations of algorithmic system design, logic, functioning, and testing, including recommender systems.

"Providers of very large online platforms or of very large online search engines shall provide the Digital Services Coordinator of establishment or the Commission, at their reasoned request and within a reasonable period specified in that request, access to data that are necessary to monitor and assess compliance with this Regulation."
— DSA Art. 40(1)

The researcher access track under Article 40(4) operates through DSC-mediated requests to vetted researchers, while Recital 98 establishes a parallel expectation that providers facilitate access to publicly available data without formal requests. Recital 96 frames the entire architecture as serving information asymmetry correction and risk mitigation:

"Investigations by researchers on the evolution and severity of online systemic risks are particularly important for bridging information asymmetries and establishing a resilient system of risk mitigation"
— DSA Rec. 96

Key Developments

No formal enforcement decisions or court rulings interpreting Article 40 have been published as of this writing, given the DSA's recent application timeline for VLOPs and VLOSEs (designations began in late 2023). The Commission's opening of proceedings against designated platforms under other DSA provisions—notably Articles 34–35 on systemic risk assessments—signals that Article 40 data access requests will likely follow in those investigations.

Two emerging practical thresholds can be identified from the statutory text and recitals. First, commercial confidentiality does not categorically block access; Recital 97 states that "consideration of the commercial interests of providers should not lead to a refusal to provide access to data necessary for the specific research objective." Second, personal data minimization is built into the regime, with Recital 98 requiring that "Providers should anonymise or pseudonymise personal data except in those cases that would render impossible the research purpose pursued." This creates a rebuttable presumption favoring anonymization, with the burden on the researcher to justify departures.

Status of the Debate

This topic is developing. No dominant doctrinal pattern has emerged yet, primarily because Article 40 enforcement mechanisms are in their earliest operational phase. The DSCs are still building capacity to issue reasoned requests, the Commission's vetted researcher framework under Article 40(8)–(12) is being refined, and no court has interpreted the proportionality or scope limits of access obligations.

The key unresolved question is the proportionality boundary: where commercial confidentiality and trade secret protection meet the mandatory disclosure imperative. Recital 97's qualification that commercial interests "should not lead to a refusal" does not specify what protective measures (data vaults, aggregation thresholds, secure enclaves) satisfy the proportionality test. Resolution will likely come through the first contested DSC requests, Commission implementing guidance on vetted researcher criteria, or ultimately preliminary references from national courts.

Practical Guidance

• Maintain a data access readiness framework: Identify and inventory datasets falling within Article 40(1)'s scope—compliance monitoring data, algorithmic system documentation, content moderation outputs—so that reasoned requests can be fulfilled within the "reasonable period" specified.

• Build proportionality protocols for trade secrets: Develop layered disclosure approaches (aggregated data, data vaults, secure enclaves) that protect commercial confidentiality while meeting the Recital 97 threshold that commercial interests cannot justify outright refusal.

• Default to anonymization or pseudonymization: Unless the research objective demonstrably requires identifiable data, apply Recital 98's default and document the basis for any exception.

• Map publicly accessible data access points: Recital 98 creates an expectation that providers facilitate real-time researcher access to publicly available engagement data—ensure APIs or equivalent mechanisms exist for public page, group, and profile interaction metrics.

• Prepare algorithmic system documentation packages: Article 40(3) obliges explanations of design, logic, functioning, and testing of algorithmic systems including recommender systems—maintain current, auditable documentation ready for deployment upon request.