Upper Tribunal dismisses TikTok appeal against £12.7m GDPR fine

The Upper Tribunal (UT) has dismissed an appeal by TikTok against a £12.7 million monetary penalty imposed by the Information Commissioner's Office (ICO) in May 2023. The ICO issued the fine after an investigation found that the platform had violated Articles 5(1)(a), 8, 12, and 13 of the UK General Data Protection Regulation (UK GDPR) after it allowed 1.4 million children under 13 to use its service without parental consent.

TikTok claimed the ICO's penalty notice was ultra vires (beyond its powers), arguing instead that its data processing fell under the "special purposes" intended for journalistic, academic, artistic, or literary aims, and that the ICO was not entitled to issue the fine as it had not satisfied the preconditions required by section 156 of the Data Protection Act 2018. 

Following an initial rejection by the First-tier Tribunal (FTT), the UT upheld that processing is only exempt if the purpose itself is journalistic or artistic, rather than merely facilitating content dissemination.

The UT also ruled that section 3 of the Human Rights Act 1998 did not alter these preconditions, and that the transparency infringements concerned procedural obligations rather than data processing.

The UT has now returned the case to the FTT to address the remaining issues. 

In a statement welcoming the judgment, the ICO stated it will "continue to defend our original decision before the First-tier Tribunal. We remain committed to ensuring that organisations, particularly those providing online services to children, comply with their data protection obligations."

Training announcement: Freevacy provides comprehensive training for new and existing practitioners on the changes introduced by the DUA Act to the UK General Data Protection Regulation (GDPR), the Data Protection Act 2018 (DPA18), and the Privacy and Electronic Communications Regulations 2003 (PEC-Regulations). Our courses are always up to date and provide a forum for learning and discussing how to ensure your data protection processes remain compliant. Find out more.