TikTok has lost a preliminary appeal about whether its data processing was covered by the UK's special purposes exemption.
Key takeaways
- The First-tier Tribunal found that the ICO’s monetary penalty notice against TikTok did not go beyond its powers under section 156 of the Data Protection Act 2018.
- TikTok’s mission as an enabler of artistic expression was not sufficient for the tribunal to find that all its processing of personal data was for special purposes such as artistic expression.
- The judgment says the ICO could in principle enforce against TikTok’s processing of personal data of underage children, which was the subject of its penalty notice.
Shutterstock.com/LuizaKamalova
In a decision published on Friday, the tribunal said the Information Commissioner’s Office (ICO) was not required to obtain leave from a court to issue its 2023 monetary penalty notice against TikTok. The ICO had fined the platform £12.7 million (€14.5 million) over GDPR breaches related to its processing of children’s data and transparency obligations.
Following an appeal by TikTok, the First-tier Tribunal in May heard arguments on a preliminary point of whether the regulator’s penalty notice was made in respect to processing of personal data for special purposes – in particular artistic expression – and therefore exceeds its powers. Under section 156 of the Data Protection Act, the regulator cannot issue penalties relating to processing for special purposes unless certain requirements are met.
TikTok had argued before the court that its platform was a “free expression service” fundamentally designed to enable artistic expression, adding that the special purpose processing was not marginal but essential to its operations. The ICO, meanwhile, held that its penalty notice was specifically and lawfully issued with respect to the processing of data of underage users, adding that TikTok’s interpretation of article 156 was “impermissibly wide”.
First-tier Tribunal judge Catherine Harris last week ruled that the fact that TikTok’s “stated mission and overall purpose is concerned with the encouraging of creativity and creation of artistic and journalistic content” is not sufficient to render all its processing of personal data as being for special purposes. There must be more than an “accidental or incidental connection to the special purposes” for the protections under section 156 to apply, the judge said.
The fact that TikTok is a commercial entity does not necessarily mean it cannot be found to be processing personal data for special purposes under section 156, the judgment said. It added that the platform’s character as an internet service provider similarly does not in principle exclude it from the scope of the section – it is instead the specific factual context of the processing to which the notice relates to that determines whether the section is engaged.
In terms of the penalty notice itself, TikTok had submitted that it concerns processing of all UK users’ personal data which it undertakes to provide the service. It argued that the ICO’s notice attacked processing activities which are integral to its delivery of the service to all users.
But the tribunal found that the alleged unlawful processing by TikTok of underage children’s personal data “is at the very heart” of the notice.
TikTok’s arguments failed to consider that according to its own terms of service, children under the age of 13 were not permitted on the platform, the tribunal said. “It cannot therefore be said that the processing activities which are attacked in the MPN [monetary penalty notice] are in relation to a service being delivered to all its ‘users’, as children under the age of 13 are not permitted to be ‘users’.”
The tribunal also found the transparency-related findings in the penalty notice “were not given with respect to breaches of processing of personal data,” but with respect to “breaches of procedural obligations”.
Given that the tribunal found the processing operations cited in the ICO’s enforcement specifically relate to the personal data of underage users, it then considered whether this could be considered a special purpose. It accepted the regulator’s argument that by definition, TikTok’s processing of data belonging to underage users – which are explicitly banned from the platform – could not be to facilitate any purpose at all.
“Whilst we noted TikTok’s arguments about the purposes of its service being to facilitate creativity, its purpose and intention was never to do so for underage children at any time,” the Tribunal noted. “It follows therefore that TikTok’s processing in relation to underage children, which was the processing with respect to which the MPN was issued, was not for the special purposes.”
The Tribunal added that whether or not TikTok has actually infringed the GDPR provisions in question is not the issue before it. “That would be the subject of the substantive hearing in due course, if the case proceeded to such a hearing,” it said.
UK Information Commissioner John Edwards said in a statement that the decision "is a significant step forward" in the regulator's ability to hold TikTok and similar platforms to account for how they use personal information, particularly children's data, when providing their online services. "This isn’t just a successful outcome for the ICO – it’s a win for the public and allows us to continue to safeguard and protect children across the digital world," Edwards added.
Counsel to TikTok
11KBW
Anya Proops KC and Zac Sammour
5RB Barristers
Aiden Eardley KC
Counsel to the Information Commissioner’s Office
Monckton Chambers
Gerry Facenna KC, Nikolaus Grubeck and Jenn Lawrence
11KBW
Robin Hopkins