The Information Commissioner’s Office (ICO) has today, April 4, 2023, announced that it had imposed a fine of £12.7 million on TikTok for violations of the UK General Data Protection Regulation, including the abuse children’s personal data.
The ICO had in September 2022, issued a notice of intent to fine TikTok £27 million for failing to protect children’s privacy, following the ICO provisional findings that TikTok might have committed a number of violations:
- processed the data of children under the age of 13 without appropriate parental consent;
- failed to provide proper information to its users in a concise, transparent, and easily understandable way; and
- processed special category data without legal grounds to do so.
Findings of the ICO
Further to the above, the ICO outlined that, taking into consideration the representations from TikTok, it had decided not to pursue the provisional finding related to the unlawful use of special category data, which therefore was not included in the final amount of the fine set at £12.7 million.
However, the ICO confirmed that TikTok had breached the UK GDPR between May 2018 and July 2020 by:
- providing its services to UK children under the age of 13 and processing their personal data without consent or authorisation from their parents or carers;
- failing to provide proper information to people using the platform about how their data is collected, used, and shared in a way that is easy to understand, thus making it unlikely that users of the platform, in particular children, were able in practice to make informed choices about whether and how to engage with it; and
- failing to ensure that the personal data belonging to its UK users was processed lawfully, fairly, and in a transparent manner.
Notably, the ICO highlighted that a concern was raised internally with some senior TikTok employees about children under 13 using the platform and not being removed. In this regard, the ICO took the view TikTok did not respond adequately to such concerns.
