The term “hosting service provider” within the meaning of the Terrorist Content Online Regulation means something slightly different from what the term is generally taken to mean. Hosting service providers within the meaning of the Terrorist Content Online Regulation (“TCO hosting service provider”) provide services that meet the following three requirements:

• They store information.
• They store this information at the request of a content provider.
• They make this information available to the public.

Content within the meaning of the Terrorist Content Online Regulation may be individual files such as texts, images, videos or downloads but can also be entire websites or platforms if, for example, their content largely serves the purpose of disseminating terrorist content.

In practice, a distinction is made, depending on the business model offered, between indirect hosting service providers and hosting service providers within the meaning of the Terrorist Content Online Regulation (TCO hosting service provider). The Court of Justice as a Court of Criminal Judicature interpretation is that the Terrorist Content Online Regulation only fully applies to TCO hosting service providers.

A classification as a TCO hosting service provider or indirect hosting service provider applies to an individual business model (for each individual service offered by a hosting provider) and not to an individual company. A company may therefore be classified as both a TCO and an indirect hosting service provider.

TCO hosting service providers are understood to be providers offering services for the storage and dissemination of information by technical means on the internet and for the storage of information provided by and at the request of a content provider (within the meaning of Article 2 point (1) of the Regulation).

• For example, TCO hosting service providers may be providers of social media, video, image and audio-sharing services, as well as file-sharing services or other cloud services, insofar as those services are used to make the information stored available to the public at the direct request of a content provider.
• “At the request of” does not necessarily require a contractual relationship between the content provider and the hosting service provider. However, a contract between a hosting service provider and a content provider is a strong indication that the hosting service provider is to be regarded as a TCO hosting service provider.
• The hosting service providers do not have to operate the technical infrastructure used to store the information themselves.
• Hosting service providers just need to be able to have an influence on the information stored and to store the information at the request of the content provider. This does not exclusively mean a hosting service provider’s own technical influence. For instance it is sufficient if hosting service providers can completely shut off the service or have the service shut off (for example by contractual arrangement with a third party that has technical access). It should be noted that the influence exerted by the hosting service providers relates only to their ability to block or delete content.
• They do not need to be able to edit or modify the content. (Article 2 points (1) and (3) and recitals 4 and 14 of the Regulation)
• Services offered free of charge by hosting service providers may fall within the scope of the Regulation if they are very similar to services otherwise charged for (for example by a large number of other providers in the sector). (“generally provided for remuneration” pursuant to Article 1(b) Directive (EU) 2015/1535.

Indirect hosting service providers are understood to be providers that offer services for arranging hosting services or, for example, provide the technical infrastructure or other support services for other hosting service providers (such as server operators) and that are not in direct contact with the content providers. The services offered therefore do not involve storing information at the direct request of a content provider and therefore generally do not fall within the scope of the Terrorist Content Online Regulation.

The Regulation is fully applicable to TCO hosting service providers.

Under the Regulation and the Terrorist Content Online Act, hosting service providers must:

• establish a contact point (Article 15 of the Regulation);
• designate a legal representative in a Member State in which the service is offered if they do not have their main establishment in the EU (Article 17);
• comply with removal orders issued by competent authorities in the EU by the applicable deadlines (Article 3(3) and Article 4(1) and (2));
• comply with orders issued by the Court of Justice as a Court of Criminal Judicature under Article 5(4), (5) and (6);
• comply with information requirements for the administrative monitoring programme (Article 21);
• draw up a transparency report if action under the Regulation has been or was to be taken in a given year (Article 7);
• establish a complaint mechanism for the reinstatement of content or access to content where the removal of content or disabling of access to content as a result of a specific measure under the Regulation was unjustified (Article 10 in conjunction with Article 5);
• inform content providers about the removal of terrorist content or disabling of access to content (Article 11);
• inform the Malta Police Force if they become aware of terrorist content involving an imminent threat to life (Article 14(5)).

TCO hosting service providers that take specific measures pursuant to Article 5 of the Regulation must establish an effective and accessible mechanism allowing content providers to submit a complaint concerning the removal of content or disabling of access to content.

All requests must be examined promptly. If the removal of content or disabling of access to content was unjustified, the content or access must be reinstated without undue delay. The complainant must be informed within two weeks of receipt of the complaint. If a complaint is rejected, the reasons must be given.

The specified terrorist content must be removed or access to the content disabled in all EU Member States within one hour of receipt of the removal order.

The competent authority that issued the removal order and the Bundeskriminalamt must be informed when the content has been removed or access to the content has been disabled. (Article 3(3) and (6) of the Terrorist Content Online Regulation)

Please complete the template for “Feedback following removal of or disabling of access to terrorist content” set out in Annex II to the Regulation and indicate the time of the removal or disabling.

Please inform the competent authority that issued the removal order and the Malta Police Force without undue delay using the template for “Information about the impossibility to execute the removal order” set out in Annex III to the Terrorist Content Online Regulation. (Article 3(8) of the Regulation).

Please complete the template for “Information about the impossibility to execute the removal order” set out in Annex III to the Terrorist Content Online Regulation. Please inform the competent authority that issued the removal order and the Malta Police Force without undue delay and explain your reasons. (Article 3(7) of the Regulation)

The same applies in this case: the specified terrorist content must be removed or access to the content disabled within one hour.