WIRE 07.10.2026Belgium's NIS2 conformity assessment for essential entities falls due 18 April 2027
All wire
Hosaka Seven

Without undue delay and in any event within 24 hours.The clock that points at the authorities, Cyber Resilience Act Article 14(2)

Policy

A PlayStation ban now arrives with a statement of reasons and a right of appeal. The library it switches off is covered by neither.

The Digital Services Act turned account enforcement into a procedure with a paper trail and a public record. What the procedure costs you is still decided entirely by the terms.

A small hearing room set up for a formal proceeding: a table with a bound folder of tabbed papers, a water jug and glasses, a clock, and one empty chair. Through the open door, a tall stack of disc cases has been left on the corridor floor against the wall.

Two things happen when a PlayStation account is suspended. Somebody at Sony makes a decision about a person. And several hundred euros of games stop launching on a console in that person's living room.

European law has now written a fairly detailed procedure for the first. It has written nothing at all for the second. The distance between those two sentences is the whole subject, and it is worth an afternoon from anyone whose own organisation has a clause permitting it to terminate somebody's access.

The suspension stopped being a support ticket in February 2024

The Digital Services Act has applied in full since 17 February 2024, and among the things it did was take account enforcement out of customer service and put it into administrative law.

Article 17 is where the shift is. A provider of hosting services that restricts somebody must give that person a clear and specific statement of reasons. Not a notification. A statement of reasons, with a list of things in it. Three of them bite hardest and they are the three to hold:

The statement must say what the decision actually does — whether it removes content, restricts visibility, suspends the service or terminates the account — and it must give the territorial scope and the duration. "Your account has been suspended" is not a duration. Second, it must give the facts and circumstances relied on, which is a different obligation from naming the rule. Third, it must say whether automated means were used in detecting or taking the decision. There are further requirements in the same article, including the contractual or legal ground and the reason the conduct is said to breach it, and the redress routes available; they are in Article 17 and they are short enough to read.

Then the routes themselves. Article 20 requires an online platform to run an internal complaint-handling system, free of charge, open for at least six months after the decision, and to make sure the complaint is not decided by a machine on its own — qualified people have to supervise it. Article 21 adds an external route: the person may take the dispute to a body certified by a Digital Services Coordinator, and the platform has to engage with it.The word doing the work in Article 21 is engage. The body cannot impose a settlement. A platform that turns up, participates properly and declines to change its mind has complied with the article.

And Article 24(5) sends the statement of reasons to the European Commission, for publication in a machine-readable database that anybody can read.

The procedure has a floor. The loss does not.

A comparison that holds, because most of this publication's readers have sat through one.

When an employer dismisses somebody, the process has a statutory floor: written reasons, a hearing, an appeal heard by someone who did not take the first decision. None of that floor is about money. What the dismissal costs — notice, accrued holiday, the pension — is settled by an entirely separate body of rules, and running a flawless process does not move any of those figures by a cent. The Digital Services Act is the process floor. It is a good one. It is not about the money.

Push on the comparison and it breaks in exactly one place, which is the place worth knowing. The dismissed employee's pension survives the dismissal because law says it does. Nobody has established that a purchased library survives a termination, and the terms of every closed console platform are drafted on the assumption that it does not. What was bought is licensed to an account, and the account is the object that has been switched off.

The instrument now governs how the decision is taken, how it is explained and how it is challenged. It does not govern what the decision takes with it.

Whether a refund is owed for the unusable remainder is a real question with a real answer, and the answer is in consumer law rather than in this regulation. The Digital Services Act is not a consumer instrument and does not pretend to be. It is a procedure statute that happens to attach to decisions with very large consequences.

The trigger is information, and a great many bans are not about information

Here is the part that is not in the coverage, and it is the part a compliance reader should take away.

Both Article 17 and Article 20 hook onto restrictions imposed on the ground that the information the person provided is illegal content or incompatible with the terms. Information. That framing covers a great deal of what a platform sanctions — what you typed in a message, a profile name, an uploaded clip, a shared screenshot. It sits much less comfortably over the other half of console enforcement.

The stated groundDoes the statutory procedure follow
Something you wrote, uploaded, named or sharedYes. This is what the words describe
A modified client, injected code, an unauthorised peripheralArguable, and nobody has settled it
A chargeback, a payment dispute, a suspected stolen cardNot obviously, on the words

That table is this desk's reading of the trigger, not a finding by anybody with the authority to make one. But the shape of the problem survives any correction to the detail, and the shape is this: the company that writes the ground is the company whose obligations the ground decides. Characterise a termination as a response to what somebody posted and the statement of reasons, the internal complaint system and the certified body all follow. Characterise the identical termination as an account and billing matter and a coherent argument exists that none of them do.

It is the same account, the same person and the same library either way.

Someone else's enforcement decisions, in bulk, for free

The database under Article 24(5) is the practical gift in all of this, and almost nobody outside the field has opened it.

Every statement of reasons an online platform issues goes into it. Categories of ground, the type of restriction, whether the decision was automated, the territorial scope, a free-text explanation. It is searchable by platform and it is downloadable, which means that anybody drafting an acceptable-use policy or a complaints procedure can read several hundred thousand real enforcement decisions taken by companies with rather more lawyers than they have.

Two things become visible almost at once, and the second is the useful one.

The first is that reasons at volume are templated, because at volume they have to be. A category is picked from a list and a paragraph is assembled. Nothing about that is improper, and the regulation does not require artisanal prose.

The second is what the templates do not contain. Read enough of them and the gap between a rule being named and a fact being given becomes very hard to unsee — between this breached our code of conduct and on this date, in this message, you wrote this. Article 17 asks for the second. A category plus a rule reference is the first. That distinction costs nothing to build into your own procedure on the day you draft it, and a great deal to retrofit after the first complaint that goes external.

One limit on the corpus, and it is a serious one. The database holds statements of reasons. It does not hold what happened next. You cannot see which decisions were reversed on internal complaint, which went to a certified body, or which were quietly undone by somebody in a support queue. It is a record of decisions taken, not of decisions that held.

What the terms still decide

Sony is an online platform subject to all of this, and, as far as this desk can establish, not a designated very large one — so no systemic risk assessment, no independent audit, no researcher data access. The ordinary obligations apply and they are not small.

What has not changed is the substance. Nothing in the regulation says a suspension must be proportionate to the value of what it destroys. Article 14 requires restrictions to be applied diligently, objectively and proportionately, with due regard to fundamental rights, which is about the manner of application and not about the collateral. Nothing requires the platform to preserve, return, transfer or refund what the account could reach. Nothing sets a deadline for the internal complaint to be answered. And the external body, at the end of the whole apparatus, can recommend.

Article 23 is the quiet reminder of which direction this instrument runs in. It requires a platform to suspend, after warning, users who repeatedly provide manifestly illegal content, and to set out in its terms the policy on misuse with examples of what it takes into account. The instrument that gave the reader an appeal also told the platform when to ban them, and told it to publish examples first. Steal the examples requirement for your own policy. It is the cheapest clause in the regulation and the one that prevents the most arguments.

At some point a certified body somewhere in the Union is going to take a console account termination and have to read that console's terms of service in order to decide it. It will be the first reading of those terms by anyone outside the company that wrote them. It will bind nothing, and it will be published.

Primary The document itself. Claims in this piece rest only on these.

  1. Regulation (EU) 2022/2065 (Digital Services Act), Articles 14, 17, 20, 21, 23 and 24Official Journal of the European UnionThe instrument the whole piece rests on. Paraphrased from working knowledge and not opened against the consolidated text for this draft, which is why only top-level article numbers appear in the body — 24(5) is the single sub-paragraph printed and it is the one an editor should check first. Also to be checked before this runs: the full application date of 17 February 2024; that Article 17 attaches to providers of hosting services and Article 20 to providers of online platforms; that the internal complaint-handling window in Article 20 is at least six months and that the system must be free of charge; that Article 20 requires decisions to be taken under the supervision of appropriately qualified staff and not solely by automated means; that Article 21 bodies are certified by a Digital Services Coordinator and cannot impose a binding settlement; and that Article 23 requires the policy on misuse to be set out in the terms with examples. The third section turns entirely on the words I have paraphrased as 'on the ground that the information provided by the recipient' in Articles 17 and 20. Quote that phrase exactly or cut the quotation marks. If it does not read the way I have described it, the section goes.
  2. Regulation (EU) 2022/2065, Article 21, allocation of the out-of-court dispute settlement body's feesOfficial Journal of the European UnionSeparated out because it is the claim in this piece I am least sure of. The body says the platform bears the body's fees where the complaint is upheld. I believe that is the direction of the rule and I have not read the paragraph. No figure, no cap and no reimbursement rule for the recipient's own expenses is printed here for the same reason. Check it or cut the sentence; do not approximate it.
  3. The Digital Services Act Transparency Database, established under Article 24(5)European CommissionDescribed, not queried. This desk ran no search for this piece and prints no row count, no platform's share of submissions, no date range and no proportion of decisions marked as automated. The characterisation of the submissions as category fields plus free text is from the shape of the published schema rather than from a sample I have counted this month, and it should be softened or evidenced before it runs. Anyone adding a number to this section must run the query and date it in the body.
  4. PlayStation Network terms of service and user agreement, and the community code of conduct, in the version served to users in the UnionSony Interactive EntertainmentNot opened for this draft, and the piece is written so that nothing turns on a clause. No wording is quoted, no clause is located, and no sentence here reports what Sony's terms say as against what console terms in general do. That is a deliberate retreat from the usual method of this desk and the editor should know it. If the piece is to name a clause, someone must pull the current EU-facing terms, an archived copy of an earlier version and the identity of the contracting entity, and put all three on the desk. Also unestablished here: which Sony entity carries the Union obligations, whether a legal representative has been designated under the DSA, and what happens to an already-activated console that is offline when a suspension lands. The body hedges that last point rather than asserting it.
  5. Commission designation decisions for very large online platforms under the Digital Services ActEuropean CommissionThe body states, as this desk's understanding and not as a checked fact, that the PlayStation Store is not among the designated very large online platforms. The current list was not opened for this draft. Either check it against the Commission's published list and date the check, or cut the sentence — the argument does not need it, because the obligations discussed all attach to ordinary online platforms above the micro and small enterprise threshold.

Reporting Attributed, not relied on. Where the reporting is the fact, it says so.

  1. Certified out-of-court dispute settlement bodies under Article 21This desk has not established how many bodies are certified, in which member states, what they charge, how long they take, or whether any has yet handled a games console account termination. The body says so rather than implying an answer, and the closing paragraph is written as a prediction about a first, not a report of one. If anybody edits a number in here it needs a Digital Services Coordinator's own register behind it.

Lead Pointed us at the story. Nothing here is cited as authority.

  1. Placeholder: reader correspondence and public forum accounts of console account suspensionsWhere the story came from. Cited for nothing. No case, no user, no sanction and no figure from any of it appears in this piece, and none should be added without a document.

Nadia Berger

Platforms

I write about AI in the enterprise: who is deploying it, who is regulating it and who is quietly getting it wrong. I like a good hype cycle almost as much as watching one deflate.