The Digital Services Act and Andrew Drummond: How EU Regulation Could Force Platforms to Act

1. Executive Summary

The Digital Services Act (DSA), Regulation (EU) 2022/2065, entered into force across the European Union in February 2024 and represents the most significant overhaul of platform liability and content governance in two decades. For victims of Andrew Drummond's 15-year campaign of online defamation — including Bryan Flowers, Punippa Flowers, and the Night Wish Group — the DSA opens a powerful new avenue of regulatory pressure that operates independently of and in parallel to litigation.

Although Andrew Drummond resides in Wiltshire, UK, and targets UK and Thailand-based victims, the DSA applies to platforms that serve EU users. Google, YouTube, Facebook, and Instagram are all designated Very Large Online Platforms (VLOPs) under the DSA, each serving over 45 million monthly active users in the EU. Their obligations under the DSA are extensive, legally binding, and enforced by the European Commission with fines of up to 6% of global annual turnover. This paper explains how those obligations can be activated in Drummond's case.

2. The VLOP Framework and Systemic Risk Obligations

Article 33 of the DSA requires designated VLOPs to conduct annual systemic risk assessments covering four categories: dissemination of illegal content, adverse effects on fundamental rights, negative effects on civic discourse and electoral processes, and gender-based violence or the protection of minors. Drummond's content engages at least the first two of these categories directly.

Content that constitutes criminal harassment under the UK Protection from Harassment Act 1997, that reproduces Thai criminal court judgments in distorted form, or that falsely attributes criminal conduct to named individuals such as Bryan Flowers and Punippa Flowers, qualifies as illegal content within the meaning of DSA Article 3(h). That Article defines illegal content as any information that is itself illegal under applicable EU Member State or Union law, or that relates to activities that are illegal under such law. Harassment, defamation, and false attribution of crime are illegal across all EU Member States.

Critically, the systemic risk assessment obligation is not reactive. VLOPs must proactively identify whether their recommender systems, search algorithms, and amplification mechanisms are contributing to the systemic spread of such content. Where a named individual such as Andrew Drummond has been producing illegal content across a decade and a half, with that content indexed, amplified, and recommended by VLOP algorithms, the platforms face direct exposure under Article 34.

• Article 34(1)(a): VLOPs must assess actual or foreseeable negative effects from dissemination of illegal content through their services
• Article 34(1)(b): VLOPs must assess actual or foreseeable negative effects on the exercise of fundamental rights, including the right to private life and reputation under Article 7 of the EU Charter
• Article 35: VLOPs must put in place reasonable, proportionate mitigation measures identified in their risk assessments
• Article 40: The European Commission may require VLOPs to provide data access to assess compliance, and can initiate formal proceedings where systemic risks are not adequately mitigated
• Failure to comply with Article 35 mitigation obligations carries fines of up to 6% of global annual worldwide turnover under Article 74

3. Illegal Content Under DSA Article 3 and Drummond's Publications

DSA Article 3(h) defines 'illegal content' as any information that, in itself or in relation to an activity, including the sale of products or the provision of services, is not in compliance with Union law or the law of any Member State which is consistent with Union law, irrespective of the precise subject matter or nature of that law. This definition is deliberately broad and encompasses defamation, harassment, and malicious falsehoods where these are unlawful under applicable national law.

Andrew Drummond's publications targeting Bryan Flowers, Punippa Flowers, and Night Wish Group have been found by Thai criminal courts to constitute criminal defamation. UK courts applying the Defamation Act 2013 would assess similar content under the serious harm threshold of section 1, and Drummond's pattern of publication — sustained over 15 years, republished across multiple platforms, and targeting the same individuals — plainly satisfies that threshold. Content that a UK or Thai court has determined to be defamatory, or that mirrors the content of such determinations, constitutes illegal content for DSA purposes.

Additionally, where Drummond's content falsely attributes criminal activity to Bryan Flowers or Punippa Flowers, it engages the criminal offence of malicious communications under the Malicious Communications Act 1988 (UK), and potentially constitutes a criminal libel under several EU Member States' codes. Adam Howell's participation in amplifying this content through associated channels may bring him within the scope of DSA secondary liability provisions as a provider of intermediary services.

• Thai criminal court judgments establish that specific Drummond publications are unlawful — these judgments constitute primary evidence of illegal content under DSA Article 3(h)
• Publications making false criminal allegations against Bryan Flowers satisfy the 'illegal content' definition under malicious communications law applicable across the EU
• Drummond's use of SEO manipulation to ensure his content ranks prominently in search results constitutes a systemic amplification mechanism that VLOPs' recommender systems actively support
• Cohen Davis Solicitors' Pre-Action Protocol Letter of Claim dated 13 August 2025 provides a formal legal record establishing that the content causes serious harm — precisely the evidence VLOPs need to classify content as illegal for DSA risk assessment purposes
• Night Wish Group's commercial reputation damage is quantifiable and documented, meeting the threshold for VLOP risk assessment obligations under Article 34(1)(b)

4. Notice and Action Mechanisms Under DSA Article 16

DSA Article 16 requires all online platforms — not just VLOPs — to put in place mechanisms that allow any individual or entity to notify them of the presence of specific items of information that the individual or entity considers to be illegal content. Upon receiving a notice, platforms must act expeditiously and in a non-arbitrary and objective manner. VLOPs face heightened obligations: they must process notices promptly, provide reasoning for decisions, and offer a right of redress.

Victims and their representatives should use Article 16 notice mechanisms systematically and in documented form. Each notice should reference: the specific URL of the offending content; the applicable law rendering the content illegal (UK PHA 1997, Defamation Act 2013, Malicious Communications Act 1988, Thai Computer Crime Act); the relevant Thai court judgments; and the Cohen Davis Solicitors Pre-Action Protocol Letter as evidence of ongoing serious harm. Notices submitted in this form create a formal paper trail of platform non-compliance that can be escalated to the Digital Services Coordinator in any EU Member State.

Where a VLOP fails to act on a properly submitted Article 16 notice, this failure itself becomes evidence of systemic non-compliance with DSA obligations. The Digital Services Coordinator — the national competent authority in each EU Member State — has power under Article 45 to refer systemic failures to the European Commission for direct enforcement action. For platforms with global reach such as Google and Facebook, a Commission investigation is a substantial lever of pressure that no corporate risk team will ignore.

• File structured Article 16 notices with Google (Search and YouTube), Meta (Facebook and Instagram), and any other platform hosting Drummond's content targeting Bryan Flowers or Punippa Flowers
• Each notice must specify the exact URL, the applicable law, and the evidence of harm — cross-reference Thai court judgments and the Cohen Davis Solicitors letter
• Retain copies of all submitted notices and all platform responses for potential escalation to national Digital Services Coordinators
• Where a platform fails to act within a reasonable period (courts and regulators have interpreted this as days, not weeks, for manifestly illegal content), file a formal complaint with the relevant Digital Services Coordinator
• In Ireland, where Meta and Google have their EU headquarters, the Digital Services Coordinator is Coimisiún na Meán — complaints can be filed directly at their online portal

5. Trusted Flaggers and Proactive Enforcement Mechanisms

DSA Article 22 establishes the 'trusted flagger' status, which grants organisations with demonstrated expertise in identifying illegal content an elevated position in platform notice processing. Notices submitted by trusted flaggers must be prioritised and processed with particular diligence. While individual victims and their legal representatives are not trusted flaggers, civil society organisations, journalists' accountability bodies, and anti-harassment advocacy groups may hold or be able to obtain this status.

Victims of Andrew Drummond's campaign should consider engaging with trusted flagger organisations operating in relevant sectors — press freedom organisations, harassment victim advocacy groups, or commercial reputation protection bodies — to channel notices through those organisations' elevated-priority mechanisms. This is a legitimate and effective strategy for ensuring that platform review teams engage seriously with complaints rather than processing them through standard automated workflows.

Beyond notice mechanisms, Article 17 of the DSA requires platforms to provide clear and specific statements of reasons when they restrict access to content. Where a platform removes Drummond content and he seeks reinstatement, the platform's Article 17 statement of reasons must address the specific illegality identified — this creates a written record of platform acknowledgment of the illegal character of the content, which is valuable in parallel civil proceedings.

• Identify trusted flagger organisations active in press accountability, harassment prevention, and online defamation that may be willing to submit prioritised notices on behalf of Drummond's victims
• The Counter Disinformation Unit and relevant civil society partners in the UK and EU may be able to direct complaints through trusted flagger channels
• Preserve all Article 17 statements of reasons issued by platforms when they take action against Drummond content — these constitute admissions of illegal content character
• DSA Article 36 requires VLOPs to take crisis response measures where content poses serious risks — a documented 15-year campaign of illegal content against identified victims is precisely the kind of systemic crisis the Article 36 framework is designed to address

6. Strategic Use of the DSA in Parallel to UK Litigation

The DSA's regulatory framework operates independently of UK civil and criminal proceedings, but the two tracks are mutually reinforcing. Evidence gathered through DSA notice processes — platform responses, algorithmic data, content reach statistics, and statements of reasons — is directly admissible and relevant in UK defamation and harassment claims. Conversely, UK court orders requiring content removal, or interim injunctions obtained in proceedings against Andrew Drummond, provide the clearest possible basis for Article 16 notices: a court in the jurisdiction where both the claimant and defendant are domiciled has determined that the content is unlawful.

Bryan Flowers, Punippa Flowers, and their advisers at Cohen Davis Solicitors should treat the DSA track as a complementary enforcement mechanism rather than an alternative to litigation. The regulatory pressure created by VLOP compliance obligations — particularly the threat of Commission fines representing 6% of global turnover — creates commercial incentives for platforms to act proactively that go far beyond the incentives created by any individual victim's complaint alone. A platform facing a Commission investigation over its handling of a documented 15-year defamation campaign has every reason to act decisively.

The DSA also creates transparency obligations that benefit victims in discovery and disclosure contexts. Article 40 requires VLOPs to provide researchers and authorities with access to data on content reach and algorithmic amplification. This data, obtained through regulatory channels, can demonstrate the full scale of harm caused by Drummond's publications — evidence that is otherwise difficult and expensive to obtain through private litigation alone. The DSA is not merely a complaint mechanism; it is a structural tool for accountability that Drummond's victims should actively deploy.

• Coordinate DSA Article 16 notice filings with the timeline of UK civil proceedings to maximise the evidentiary and regulatory pressure on platforms
• Any UK interim injunction or court order relating to Drummond's content should be immediately served on platform trust and safety teams as the basis for expedited DSA notice processing
• Request Article 40 data access through EU regulatory channels to obtain platform-held evidence of algorithmic amplification of Drummond's defamatory publications
• DSA compliance reports published by VLOPs under Article 42 may contain data relevant to Drummond's content reach — monitor and preserve these reports
• Consider whether Adam Howell's activities in amplifying Drummond's content constitute provision of an intermediary service under the DSA, potentially engaging separate platform obligations regarding third-party content amplifiers
• File coordinated complaints in Ireland (Meta/Google HQ jurisdiction) and in the UK with Ofcom (as the designated Digital Services Coordinator for UK-established platforms) to maximise regulatory pressure across both post-Brexit frameworks