In April 2023, the Information Commissioner’s Office (ICO) issued a £12,700,000 Monetary Penalty Notice (MPN) to TikTok. The ICO issued the MPN as, in their view, TikTok had:
- Processed the personal data of children under the age of 13 without valid parental consent and without any other lawful basis for the processing;
- Failed to provide transparent information to users in relation to processing; and
- Breached the principle of lawfulness, fairness, and transparency.
Further information in relation to the MPN can be found here.
TikTok appealed the decision to the First Tier Tribunal and argued that the ICO did not have the power to issue the MPN because the processing fell within Section 156 of the Data Protection Act 2018 (DPA).
Section 156 restricts the ICO’s power to issue a penalty notice when the processing of personal data is carried out for a “special purpose”. The special purposes are defined within Section 174 of the DPA. One of the special purposes is for artistic purposes. In their appeal, TikTok argued that its platform facilitates artistic expression and, therefore, its data processing falls within Section 156. In support of its position, TikTok relied upon the expert evidence of Professor Catherin Abell, who found that nearly half of the top 100 videos on TikTok during the relevant period were artistic.
The Tribunal was therefore tasked with the following:
1. Determining the scope and meaning of Section 156;
2. The processing in relation to which the MPN was given; and
3. Whether the processing was for a special purpose.
The Tribunal’s decision
In support of its position Tik TikTok looked at whether the content on its platform was of an artistic nature. The Tribunal concluded that this was the wrong approach as it did not relate directly to the processing that had resulted in the MPN.
In relation to the MPN, the Tribunal concluded that it was clearly in relation to the alleged unlawful processing by TikTok of the personal data of underage children. This was ultimately at the heart of the MPN. The question, therefore, was whether this specific processing was for an artistic purpose.
The Tribunal ultimately concluded that, as TikTok had acknowledged that the platform should not be used by anyone under the age of 13, any processing in relation to such data did not and could not facilitate the use of the platform and accordingly, was not for a special purpose.
By virtue of the above, the ICO was not required to obtain leave from the Court under Section 156 before issuing the MPN.
Comment
This decision is an important reminder for platforms trying to hide behind certain provisions to avoid regulatory action. This is particularly important in the context of the processing of children’s data where there are more stringent rules that must be followed by organisations.
How can we help?
Ruby Raine-Ellerker is a Senior Associate in our expert Dispute Resolution team, specialising in data breach claims, inheritance and Trust disputes and defamation claims.
If you need any advice, please do not hesitate to contact Ruby or another member of the team in Derby, Leicester, or Nottingham on 0800 024 1976 or via our our online enquiry form.
Contact us