After Russmedia, does the GDPR override DSA rules on online speech?

In an op-ed for Tech Policy Press, Daphne Keller of Stanford Law School examines the Russmedia ruling in which the Court of Justice of the European Union (CJEU) prioritised the EU General Data Protection Regulation (GDPR) over intermediary liability rules. The ruling suggests that data protection laws may now eclipse the Digital Services Act (DSA), potentially incentivising platforms to remove significant amounts of lawful expression.

The conflict stems from content that qualifies as both user speech and personal data. While the DSA provides a structured notice and takedown process for speech, the Russmedia decision suggests that GDPR-based claims could strip platforms of immunity for hosting content. This shift could legally pressure platforms to proactively monitor and filter uploads without notifying users or allowing appeals.

Keller argues that while the DSA was specifically designed to balance competing rights and account for the practicalities of content moderation, the Russmedia ruling risks undermining these negotiated protections. By relying solely on the GDPR to adjudicate speech-related disputes, courts may ignore the multi-party frameworks established in the DSA, leading to serious consequences for online information rights and the mechanics of platform moderation.

Training Announcement: Freevacy offers a range of independent data protection qualifications from IAPP and BCS. Our certified courses are available at foundation and practitioner levels and cover multiple legal jurisdictions, data protection operations management, and the implementation of complex privacy solutions in technical environments. Find out more.