Creative differences: Wider implications of TikTok's Upper Tribunal loss

The Upper Tribunal (UT) has dismissed TikTok’s appeal on the preliminary issue of the ICO’s power to impose a monetary penalty, without first seeking a court order, given the purpose of TikTok’s processing. As discussed in our previous blog, in 2023 the ICO imposed a £12.7 million fine on TikTok in respect of various breaches of the GDPR relating to children’s data. The UT decision rejected the appeal on the preliminary issue and returned the case to the First-tier Tribunal to decide the substantive issues.

This blog focuses on two implications of the appeal - what this means for processing for artistic or journalistic purposes, and what this adds to the ongoing dialogue around children’s data and age assurance.

Court approval for enforcement where processing is for “special purposes”

Where the processing of personal data is for “special purposes”, section 156 of the Data Protection Act 2018 (DPA 2018) requires the ICO to obtain prior court approval before issuing a monetary penalty notice (MPN). 

Special purposes are defined in section 176 of the DPA 2018 as journalistic, academic, artistic or literary purposes. 

Processing for journalistic, academic, artistic or literary purposes

In its appeal, TikTok argued that its processing of children’s data, which was the subject of the MPN, fell within the scope of the special purposes definition as its algorithm promotes content made using its creator tools and content made in that way was artistic. 

However, the UT concluded that the creator tool could be used to make content without artistic value, while the algorithm was “unaware of, and indifferent to” the content’s artistic character. Further, it said that section 156 is intended to protect those who create and publish journalistic, artistic or other special-purpose content, not platforms that supply the means to distribute it. Critically, the UT determined that the word “for” indicates deliberate intention such that the processing itself must be for a special purpose. It is not enough that the processing merely facilitates content with special-purpose characteristics.

Whilst clearly relevant to other platforms, this judgment also has broader relevance for any organisations within the creative and journalistic industries or for those in academia, as the concept of special purposes in the DPA 2018 is not just limited to the ICO’s ability to impose fines. It also forms part of the exemptions from the provision of privacy notices and compliance with data subject rights requests for instance. Organisations should therefore check that they are limiting reliance on exemptions for special purposes to only those processing activities that are “for” the relevant special purpose.

Processing of children’s data and age assurance

Organisations directly offering information society services to children under 13 must collect parental consent. However, the ICO found that TikTok neither sought parental consent nor made reasonable efforts to prevent underage children from accessing its platform, and rejected TikTok’s assertion that it could rely on contractual necessity for its processing. In any event, the ICO stated in its MPN that children lacked the capacity to enter a contract and so there was no binding contract that could be relied upon. 

TikTok argued in the appeal that under-13s who signed up had committed fraudulent misrepresentation of their age and so TikTok could not be held responsible for processing their personal data. TikTok submitted that it, as the innocent party, had the right to rescind the contract or could affirm and sue for breach on the basis of the misrepresentation. This led the UT to comment that the contractual analogy was unsuitable as “the "innocent party" is a commercial entity which has made the operational and commercial choice not to require corroboration of users' warranted age with the consequence that large numbers of underage children accessed the platform during the relevant period.”

The UT’s comments can therefore be seen to reinforce the ICO’s position that contractual measures alone are not a sufficient age assurance mechanism in such scenarios.

All organisations that use contractual age restrictions should therefore note the court’s endorsement of the ICO’s position and revisit their approach. As we said in our previous article, the ICO’s position is not just that the contractual age restriction is ineffective, but that it also leads to unlawful processing of the personal data of any underage children who do, nonetheless, access the relevant service.  

In addition, it is a timely reminder for those organisations that rely widely on the contractual necessity processing ground that it is limited, and so it is an opportunity to reassess the correct lawful processing ground wherever it is sought to be relied upon.

Outlook

TikTok may look to appeal the decision but has not yet commented on this, merely saying that they are carefully considering the judgment. Regardless of that, the substantive issues are still to be determined and so this is not the last that we will hear on this particular enforcement.