Round 1 to ICO as TikTok opens £12.7m penalty appeal

TikTok has failed in its initial attempt to get its £12.7m UK GDPR fine thrown out even before its appeal got under way properly, with the First-tier Tribunal confirming the Information Commissioner’s Office did have the authority to issue the penalty.

In the penalty notice, issued back in April 2023, the regulator found TikTok had infringed Articles 8, 12, 13 and 5(1)(a) of GDPR. In response TikTok argued that its processing was for artistic purposes, so the “special purposes” provisions applied.

These provisions place additional restrictions on the ICO’s enforcement action where personal information is being processed for journalistic, artistic, academic or literary purposes. They are referred to in the legislation as the “special purposes”. TikTok contended the ICO had issued the fine without legal authority and that it should be quashed.

However, the Tribunal found in the ICO’s favour after concluding the fine was primarily concerned with the processing of personal information of under 13-year old children and such processing was not for the “special purposes”.

The case can now proceed to a full hearing on the substantive issues raised in TikTok’s appeal.

Information Commissioner John Edwards said: “I welcome the First-tier Tribunal’s decision. It is a significant step forward in our being able to hold TikTok, and other similar platforms, to account for how they use people’s information, particularly children’s, when providing their online services.

“This isn’t just a successful outcome for the ICO – it’s a win for the public and allows us to continue to safeguard and protect children across the digital world.”

The move comes as TikTok is set to hire one of the ICO’s most senior officials in a move that could provoke concerns about conflicts of interest.

Stephen Bonner, the ICO deputy commissioner for regulatory supervision is joining TikTok later this year as the head of the company’s European data protection department.

Bonner’s move, which was first reported by Politico, has been criticised as an example of the so-called revolving-door for public servants moving from roles in which they held businesses to account into roles at those same regulated companies.

Dozens of former public servants have moved into the private sector in fields that directly overlap with their previous roles – particularly in the social media and technology sectors – raising concerns about conflicts of interest.

Open Rights Group legal and policy officer Mariano delli Santi said: “Stephen Bonner’s move is the latest of a long list of cases where the ICO has failed to uphold decent standards of public life. Civil servants should use their position to pursue the public interest, not their own career goals.”

However, ICO deputy CEO Paul Arnold has defended Bonner’s move. In a statement sent to Recorded Future News, he said: “Stephen has been an integral part of our success for the past four years and we wish him all the best as he returns to the private sector.

“All former ICO employees in new employment are subject to strict legal and contractual duty of confidentiality, something set out in the Data Protection Act.”