In October 2024, Cyprus enacted Law 116(I)/2024 on the Prevention of the Dissemination of Terrorist Content Online to align its legal framework with EU Regulation 2021/784. Both the Law and the Regulation aim to establish a robust framework for preventing the spread of terrorist content online, thereby enhancing public safety and ensuring the security of citizens. The Law applies to all online hosting service providers operating within Cyprus, regardless of their primary location, and mandates cooperation with EU member states and authorities. For the purposes of the framework, terrorist content is defined as material that incites or encourages terrorism, provides instructions related to terrorist activities, or in any way promotes participation in terrorist organizations.
The framework established does not place a direct burden on the content creator, user, or author of terrorist content; rather, it regulates the obligations and actions of hosting service providers. The requirements imposed are stringent. The framework introduces Removal Orders, which are issued by the Courts at the request of the Police, the designated competent authority in Cyprus. Hosting service providers are mandated to remove or disable access to terrorist content within one hour of receiving a Removal Order, creating a notably narrow window for compliance. Beyond legal adherence, hosting service providers are also obligated to implement proactive measures. For instance, they must employ technical tools and human oversight to prevent the re-upload of content that has already been identified as terrorist.
Cross-border Removal Orders are also provided for under this framework. These orders are issued by the local authority of one member state and communicated to the competent authority in the member state where the hosting service provider has its main establishment or representative. The cross-border Removal Order is reviewed to ensure it does not violate the Regulation or the fundamental rights and freedoms protected by the EU. Both hosting service providers and content providers may submit a reasoned request for scrutiny of the cross-border Removal Order to the member state where the hosting service provider is primarily based or represented, within 48 hours of issuance.
The Law also stipulates penalties for non-compliance. If a hosting service provider fails to comply with a Removal Order within the required timeframe, it commits an offense punishable by up to three (3) years of imprisonment and/or a fine of up to €170.000,00. Additionally, the Court, upon request from the Police, has the authority to order the termination of a website or block access to a site hosting terrorist content. Beyond compliance with Removal Orders, a hosting service provider is also subject to the same penalties for failing to notify the Police of content that poses an imminent threat to life. Consequently, the Law imposes practical obligations on content moderation and mandates reporting responsibilities to competent authorities.
Administrative penalties are an additional tool of the Law. In Cyprus, the Ministry of Energy, Commerce and Industry is the competent authority for the imposition of sanctions to hosting service providers that have their main establishment or representative in Cyprus. The Ministry may impose financial penalties on hosting service providers that systematically or persistently fail to remove or disable access to terrorist content across all EU member states, either as promptly as possible or within one hour of receiving a Removal Order. The fine is considerable, as it can amount to up to 4% of the total global turnover from the financial year preceding the violation. Hosting service providers may challenge the fine before the Administrative Court.
In addition to the above, the Law and the Regulation establish transparency and cooperation mechanisms among member states. The Regulation further promotes collaboration between competent authorities and EUROPOL to ensure consistent enforcement. Likewise, it facilitates the exchange of information between hosting service providers and regulatory bodies.
Freedom of expression and information are significant concerns for many EU citizens, necessitating that the actions of authorities remain proportionate to avoid unintended censorship. In an era marked by the rapid dissemination of information, the Regulation provides a framework designed to address the misuse of hosting service providers, emphasizing swift responses and cross-border cooperation. However, this raises the question: will the Regulation achieve its intended outcome, or will it simply drive terrorist content to less conventional online platforms beyond mainstream oversight?
The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.
