TikTok Inc v The Information Commissioner

In April 2023, the Information Commissioner issued TikTok with a Monetary Penalty Notice of £12.7m for the processing of underage users’ data and defective privacy notices (“the MPN”).

TikTok appealed the MPN to the First-tier Tribunal (“the FTT”) on several grounds. Judge Griffin directed that the FTT consider the following preliminary issue (“the vires challenge”):

“Was the MPN issued by the Commissioner under s.155 and Schedule 16 of the DPA 2018 on 4 April 2023 made “with respect to processing of personal data for the special purposes” within the meaning of ss.156 and 174 DPA?”

The FTT dismissed the vires challenge. TikTok was granted permission to appeal to the Upper Tribunal (“the UT”), in a decision that suspended the effect of the FTT’s Decision pending determination of the appeal.

1. Whether the FTT erred in law by construing those parts of the MPN that concerned breaches of Articles 5(1)(a) and 8 UK GDPR as being only with respect to the processing of the data of underage children (Ground 1).
2. Whether the FTT erred by holding that, as TikTok did not wish underage children to use its platform, its processing of their data in the delivery of the TikTok platform service to them could not be for the special purposes (or, indeed, any purpose at all) (Ground 2).
3. Whether the FTT erred in law in holding that the parts of the MPN penalising TikTok for breaches of Articles 12 and 13 UK GDPR were not given with respect to the processing of personal data at all, but in relation to procedural obligations (Ground 3).
4. Whether the FTT erred by failing to read and give effect to section 156 compatibly with the ECHR rights of TikTok and its users (Ground 4).
5. Whether the FTT erred in law in its obiter finding that the MPN could survive in part even if some of the processing in respect of which it was given was “for the special purposes” (Ground 5).

The UT dismissed the appeal on the preliminary issue.

The UT addressed Grounds 2 and 4 together, which concerned the proper interpretation of section 156 DPA 2018 at [30]-[68].

The UT dismissed Ground 2 on the basis that the processing covered by the MPN was not for the special purposes. The UT was not persuaded by TikTok’s case that the question should be approached in a manner analogous to that taken in BBC v Sugar (No.2) [2012] 1 WLR 439, where the majority of the Supreme Court determined that, under the Freedom of Information Act 2000, the question whether information was held “for” the special purposes had to be approached by considering the “proximity” of the information to the special purposes, or in other words by applying a “directness of purpose” test: [42]-[43]. Despite accepting that a significant proportion of the content available on TikTok during the relevant period was “artistic” in nature; that TikTok provided various “creative tools“ to users which could be used to produce artistic works; and that the TikTok algorithm was attuned to promote videos that had been made using these creative tools, the UT found nevertheless that the processing with respect to which the MPN was made (which it held to be the processing involved in delivering the TikTok service to underage users) was not “for” the special purposes. The use of the “creative tools” for the creation of content was not a reliable indicator as to whether the resulting content was artistic in nature and so the use of an algorithm that promoted content created using the tools was insufficient to show that the processing was “for” the special purposes. In fact, the UT found, TikTok’s system, “distributes content to users …according to the algorithm’s prediction of whether and to what extent a particular user will engage with that content, irrespective of its artistic or non-artistic nature”: [48]-[55].

Although it held that this finding was dispositive of Ground 2, the UT also upheld the FTT’s decision (as it characterised it) that, because TikTok did not intend to process the personal data of underage users at all (having a policy that under-13’s should not be allowed on the platform), it cannot have been processing their data for the special purposes: [58]-[59].

In relation to Ground 4, the UT emphasised how section 156 DPA 2018 gives effect to the balance of rights inherent in the Convention. This engages both the Article 10 rights of TikTok and its users seeking to express themselves, and the Article 8 rights of those using the service, which in this instance involves the data rights of children and those of underage children. The UT dismissed Ground 4, on the basis that the FTT’s approach to section 156 DPA 2018 was consistent with both Article 85 UK GDPR and the interpretative duty in section 3 HRA 1998 [66].

The UT held that the processing was not “for the special purposes” and as such, Grounds 2 and 4 fail [67].

As such, the UT stated that it was no longer strictly necessary to determine Grounds 1 and 3 but addressed them briefly in light of the full argument it had heard.

As to Ground 1, the UT recognised that if, as is hinted in the FTT’s refusal of permission to appeal, but is not apparent from the FTT Decision itself, the FTT relied on evidence as to what the Commissioner said he intended the MPN to cover rather than its own analysis of the words of the MPN in their particular context, that was the wrong approach. However, the UT construed the MPN itself and noted that had the FTT not erred in its approach, it would have come to the same conclusion, and any such error was not therefore material [101].

The UT dismissed Ground 3, finding that the FTT did not err in deciding that the penalty for breach of Articles 12 and 13 was not given with respect to the processing of personal data [113].

As the UT dismissed Grounds 1-4, there was no further need to address Ground 5.

Unless there is a further appeal, the case will now return to the FTT for consideration of TikTok’s substantive challenge to the MPN.

There are two interesting aspects of this Decision.

First, the UT’s engagement with what processing “for the special purposes” means for the purposes of section 156 DPA 2018 in the context of a social media platform.

Although there was evidence before the FTT as to the proportion of videos on TikTok which constituted or represented “art”, which Professor Abell considered was a little under half, the UT did not enter into the question of “what is art?” The UT made clear that even though the material on TikTok may or may not be “artistic”, “processing is “for the special purposes” only where the purpose of the relevant processing is itself journalistic, academic, artistic or literary.” [46]-[55] The UT noted that “however TikTok might see itself, and whatever its mission statement (to “inspire creativity and bring joy”) or aspirations might be, the relevant purpose for section 156 DPA 2018 is the purpose of the processing itself, not the broader aspirations or values of the controller” at [53]. The UT found at [55] that TikTok’s “purpose” is to publish users’ video content to the platform and to distribute it to users whom the algorithm predicts are likely to engage with it.

Second, the UT’s observations on the FTT’s case management powers. At [12]-[13] the UT noted that although the FTT has the power to order the determination of a preliminary issue, the FTT should exercise caution before separating cases into preliminary and substantive issues, noting the delay between the initial challenge to the MPN issued in April 2023, which had only reached the stage of an appeal to the UT in relation to a preliminary issue as of 2026.