TikTok Inc & Anor v The Information Commissioner

Facts

TikTok Inc and TikTok Information Technologies UK Ltd operated a short-form video-sharing platform on which users created, uploaded and viewed content, with a recommender algorithm directing tailored organic and advertising content to users based on their data. Between 25 May 2018 and 28 July 2020 TikTok required users to warrant that they had reached their thirteenth birthday, but it was common ground that children below that age circumvented the age gating by entering a false date of birth. Following a Notice of Intent given on 23 September 2022, the Information Commissioner issued a monetary penalty notice on 4 April 2023 in the sum of £12,700,000 for breaches of Articles 5(1)(a), 8, 12 and 13 of the UK General Data Protection Regulation. TikTok appealed to the First-tier Tribunal, contending among other grounds that the notice was ultra vires because it was given with respect to the processing of personal data for the special purposes — here artistic purposes — without the preconditions in section 156(1) of the Data Protection Act 2018 having been met. Judge Griffin directed that this vires challenge be heard as a preliminary issue, and a panel of Judges Harris and Kiai dismissed it. Permission to appeal was granted by Judge Wikeley, and a three-judge panel of the Upper Tribunal heard the appeal.