TikTok Inc & Anor v Information Commissioner [2025] UKFTT 798 (GRC)

[2025] UKFTT 00798 (GRC)

Case Reference: EA/2023/0280/FP

First-tier Tribunal

(General Regulatory Chamber)

Information Rights

Venue Heard at: Field House, Breams Buildings, London

Hearing Heard on: 19-21 May 2025

Date 25 July 2025

Amended under the slip rule

Before

JUDGE HARRIS

JUDGE KIAI

Between

TIKTOK IncAppellant

TIKTOk INFORMATION TECHNOLOgies UK LimitedAppellant

INFORMATION COMMISSIONERRespondent

Anya Proops KC, Aidan Eardley KC & Zac Sammour for Appellants

Gerry Facenna KC, Robin Hopkins, Nikolaus Grubeck & Jenn Lawrence. for Respondent

Decision: The Tribunal determines that the MPN issued by the Commissioner under s.155 and Schedule 16 of the DPA 2018 on 4 April 2023 was not made “with respect to processing of personal data for special purposes” within the meaning of ss.156 and 174 DPA 2018.

REASONS

[1]Both members of the Tribunal have contributed to this decision. Background to the appeal

The Monetary Penalty Notice

[2]On 4 April 2023 the Information Commissioner (“IC”) issued a Monetary Penalty Notice (“MPN”) addressed to TikTok Inc (“TTI”) and TikTok Information Technologies UK Limited (“TTL”) (together “TikTok”). The MPN was predicated on the following propositions:a. TTI and TTL were controllers (and TikTok was a joint controller) in respect of personal data of users and account holders located in the UK (“UK users”), within the meaning of section 6 of the Data Protection Act 2018 (“DPA 2018”) and Article 4(7) of the UK General Data Protection Regulation (“the UK GDPR”).

b. In providing its services, TikTok processed UK users’ personal data, amongst others to support the provision and functionality of TikTok’s services, and to monetise such services, including by providing targeted advertising to its UK users and by offering in app purchases. The personal data being processed fell within Article 4(1) of UK GDPR because it is “information relating to an identified or identifiable natural person”.

c. TikTok’s processing of the personal data of UK users comes within the scope of the DPA 2018 and UK GDPR by virtue of Section 207 of DPA 2018 and Article 3 UK GDPR.

[3]The MPN found that TikTok had infringed parts of Articles 8, 12, 13, and 5(1)(a) of UK GDPR. The key points were as follows:a. TikTok infringed Article 8 of the UK GDPR because it provided its services to UK users under the age of 13 (referred to in this decision as “Underage Children”) and processed their personal data without consent being given or authorised by the holder of parental responsibility over such child users and without identifying any lawful basis for processing other than consent. While TikTok purported to rely, in part, on contractual necessity as its lawful basis for processing the personal data of children under 13, the IC considered that the legal test for contractual necessity was not met. In addition, TikTok failed to make reasonable efforts to ensure that consent was given or authorised for underage child users of its video sharing platform and/or to prevent children under 13 from accessing its service (in circumstances where it relied upon such services being restricted to users over the age of 13).

b. TikTok infringed Article 12 UK GDPR because it failed to take appropriate measures to provide the information required under Article 13 UK GDPR to data subjects in a concise, transparent, intelligible and easily accessible form, using clear and plain language, in particular in relation to information addressed specifically to children.

[4]TikTok infringed Article 13 UK GDPR because it failed to provide data subjects with the information required under Articles 13(1) and (2) UK GDPR.

[5]In failing to comply with these requirements, TikTok infringed Article 5(1)(a) UK GDPR because it failed to ensure that the personal data of its UK users was processed lawfully, fairly and in a transparent manner.

[6]The MPN was issued further to section 155 DPA 2018 which gives the IC a power to impose a penalty in the form of an administrative fine. It was also issued under Schedule 16. In this case the MPN imposed a fine of £12,700,000 on TikTok. It is this MPN which TikTok now appeals. The Preliminary Issue is concerned with part of this appeal. Abbreviations used in this decision “CJEU” means the Court of Justice of the European Union “1995 Directive” means Directive 95/46/EC of the European Parliament and the Council “2015 Directive” means Directive (EU)2015/1535 “DPA 1998” means the Data Protection Act 1998 “DPA 2018” means the Data Protection Act 2018 “ECHR” means the European Convention on Human Rights “ECtHR” means the European Court of Human Rights “GDPR” means Regulation (EU) 2016/679 of the European Parliament and of the Council “IC” or “ICO” means the Information Commissioner “ISP” means internet service provider “MPN” means Monetary Penalty Notice “NOI” means Notice of Intent “PA” means personalised advertising. “platform” means TikTok’s online video sharing platform “Preliminary Issue” means the preliminary issue set out at paragraph 16 below “Relevant Period” means the period from 25 May 2018 to 28 July 2020 inclusive “Service” means the platform service TikTok offers to users “TA” means targeted advertising “TikTok” means TTI and TTL together “TTI” means TikTok Inc “TTL” means TikTok Information Technologies (UK) Limited “UK GDPR” means the UK General Data Protection Regulation “Underage Children” means children under the age of 13 Procedural matters concerning the hearing

[7]The Tribunal considered an OPEN bundle of documents (2035 pages) which was provided in two separate parts. The parties also submitted a joint authorities bundle (1352 pages) and additional joint authorities bundle (290 pages). In this decision we refer to page numbers of documents in these bundles with the prefixes OB1, OB2, AB and AAB respectively. TikTok also provided the Tribunal with a number of authorities in hard copy at the hearing, including copies of the GDPR and 1995 and 2015 Directives.

[8]The Tribunal also considered a CLOSED bundle of withheld documents (265 pages). Prior to the hearing an application under rule 14 of the Tribunal Rules had been made as regards the withheld material and an order made that disclosure of the information contained in the CLOSED bundle should not be disclosed or published to any person other than the parties in this case pending further order. On the basis of the submissions made by the parties at the hearing as to the relevance of the contents of these documents to the Preliminary Issue, the Tribunal was content that the existing Rule 14 order should remain in place.

[9]The Tribunal prepared a single OPEN decision in this matter. There was no CLOSED session within the hearing (as agreed by both parties), so a CLOSED annex was not required. The Appeal

[10]By Notice of Appeal dated 5 June 2023 TikTok appealed to the Tribunal under section 162 of the DPA 2018 on several grounds. Ground 1 of the appeal, which is the only relevant one for the purposes of the Preliminary Issue, was formulated as follows:

“The MPN falls to be quashed (and may not be substituted by the Tribunal) because it is a penalty notice which the IC had no power to issue.”

[11]TikTok amplified this ground as follows at paragraph 4 of the Grounds of Appeal (OB1 B517):

“The ICO’s conclusion that the processing with which the MPN is concerned is not “for the special purposes” is wrong in law. As is apparent from MPN 160-174, this conclusion rests on a fundamental misunderstanding of the applicable legal principles, a serious misapplication of the judgment in NT1 v Google [2018-EWNHC 799(QB) (“NT1”), the wrong application of guidance and statutory provisions which have no relevance to or bearing on the underlying issues and, moreover, a failure to recognise or engage with jurisprudence which fundamentally undermines the ICO’s analysis. The ICO’s conclusions and analysis are unsustainable. The relevant processing is “for the special purposes”

. It follows that the ICO had no power to issue the MPN because the preconditions provided for in s.156 DPA 2018 have not been met. Those preconditions have been enacted in the legislation specifically in order to ensure that additional safeguards are in place where a controller is processing data “for the special purposes” and to ensure that the imperative to achieve data protection is held in a proper balance with fundamental free expression rights, consistent with the underlying objectives of the UK GDPR, and more widely with the principles underpinning the European Convention on Human Rights (the “convention)which the UK GDPR seeks to uphold. In issuing the MPN, the ICO has failed to respect these important safeguards. The result is that the ICO has issued an MPN ultra vires its powers and accordingly the MPN falls to be quashed. Moreover the MPN may not be substituted on appeal because, pursuant to s.163(2) DPA 2018, the Tribunal only has powers to issue such substituted notice as the ICO could have issued and the ICO could not have issued any penalty notice concerning the underlying subject matter of the existing MPN, because (i) its power to issue such a notice would only have arisen in circumstances where the s.156 preconditions had been met and (ii) neither of those preconditions were met in the instant case”.

[12]TikTok invited the Tribunal to consider Ground 1 as a preliminary issue.

The IC’s Response

[13]The IC responded to the Appeal through a response dated 7 August 2023. It summarised its position in relation to Ground 1 at paragraph 16 (OB1 B569):

“Contrary to Ground 1, the MPN was not given with respect to the processing of personal data for the special purposes. Neither TikTok’s processing activities permitting Underage Users to open accounts and continue to use TikTok, nor the delivery by TikTok of targeted advertising to Underage Users, nor TikTok’s failures in respect of transparency, involved processing for journalistic, academic, artistic or literary purpose within the scope of s.156 DPA. It follows that the Commissioner was not required to obtain leave from a court under s.156 before issuing the MPN and the MPN was not issued ultra vires”

TikTok’s Reply

[14]TikTok filed a Reply dated 22 September 2023. In relation to Ground 1 it summarised its position as follows:

“The ICO’s Response is premised on a misdescription of the MPN. On a fair and objective reading, the MPN has been given with respect to the processing by which TikTok provides its service to all of its users. It is not limited to the processing of the personal data of Underage Users, whether for the purposes of TA Processing or otherwise. The ICO misrepresents TikTok’s case as being concerned only with the consequences of an MPN and not the question of whether, within the meaning of s.156, the MPN has been given “with respect to the processing of personal data for the special purposes. The ICO’s case that s.156 cannot apply to platform service providers such as TikTok is untenable.”

The Preliminary Issue

[15]Whether or not TikTok has infringed the Articles of UK GDPR as set out in the MPN or at all was not the issue before us. That would be the subject of the substantive hearing in due course, if the case proceeded to such a hearing.

[16]The issues for us at this stage concern whether the ICO had the power to issue the MPN that it did, or whether it should not have issued the MPN because the processing in question fell within section 156 DPA 2018. The question (“the Preliminary Issue”) before the Tribunal was formulated in a direction given by Judge Griffin on 12 December 2023 as follows: “Was the MPN issued by the Commissioner under s.155 and Schedule 16 of the DPA 2018 on 4 April 2023 made “with respect to processing of personal data for the special purposes” within the meaning of ss.156 and 174 DPA?”.

[17]TikTok identified in its skeleton three core issues which are: a. Whether the MPN was made “with respect to” the processing of personal data inherent in the delivery of the Service to users. This is alternatively formulated by the IC as “what was the processing with respect to which the MPN was given?”. TikTok indicated at the hearing that it agreed with the IC’s formulation. We deal with the parties’ detailed submissions in relation to this in more detail below.

[18]If it was, whether, in respect of the Relevant Period, that processing was “for the special purposes” (which purposes are defined in s.174(1) DPA 2018 and include processing for “artistic purposes”) such that s.156 is engaged in respect of the MPN. Again, this is alternatively formulated by the IC as “Was such processing for the special purposes?” We consider that these two formulations are equivalent and prefer the IC’s because it is more succinct. a. If s.156 is engaged in respect of the MPN, whether that means that the appeal succeeds in toto, with the MPN effectively being treated as a legal nullity and a notice that may not be substituted by the Tribunal or whether the MPN can somehow survive either in its original form or through a substitute notice imposed by the Tribunal. The issue of legal consequences flows, in our view, from the Tribunal’s conclusion in relation to the Processing and Special Purposes Issues.

[19]Accordingly, we consider that the questions which the Tribunal must answer are:a. What is the scope, meaning and purpose of s.156? “(the “Construction Issue”)

b. As a matter of fact, what was the processing with respect to which the MPN was given? (the “Processing Issue”)

c. Was the processing with respect to which the MPN was issued for the special purposes? (the “Special Purposes Issue”)

d. What consequences flow from our findings in relation to the previous three issues? (the “Consequences Issue”)

The Legal Framework

[20]The parties took us through a number of pieces of legislation at the hearing, including the GDPR, DPA 1998, DPA 2018 and the 1995 and 2015 Directives. The principal provisions relevant to and referred to within the Preliminary Issue are as follows.

[21]Section 156 of the DPA 2018 provides:

“(1) The Commissioner may not give a controller or processor a penalty notice in reliance on section 149(2) with respect to the processing of personal data for the special purposes unless— (a)a determination under section 174 with respect to the data or the processing has taken effect, and (b)a court has granted leave for the notice to be given. (2)A court must not grant leave for the purposes of subsection (1)(b) unless it is satisfied that— (a)the Commissioner has reason to suspect a failure described in section 149(2) which is of substantial public importance, and (b)the controller or processor has been given notice of the application for leave in accordance with rules of court or the case is urgent.” (a)a determination under section 174 with respect to the data or the processing has taken effect, and (b)a court has granted leave for the notice to be given. (a)the Commissioner has reason to suspect a failure described in section 149(2) which is of substantial public importance, and (b)the controller or processor has been given notice of the application for leave in accordance with rules of court or the case is urgent.”

[22]Section 174 of the DPA 2018 provides:

“(1) In this Part, “the special purposes” means one or more of the following— (a)the purposes of journalism; (b)academic purposes; (c)artistic purposes; (d)literary purposes... (3) The Commissioner may make a written determination, in relation to the processing of personal data, that— (a)the personal data is not being processed only for the special purposes; (b)the personal data is not being processed with a view to the publication by a person of journalistic, academic, artistic or literary material which has not previously been published by the controller. (4) The Commissioner must give written notice of the determination to the controller and the processor. (5) The notice must provide information about the rights of appeal under section 162. (6) The determination does not take effect until one of the following conditions is satisfied— (a)the period for the controller or the processor to appeal against the determination has ended without an appeal having been brought, or (b)an appeal has been brought against the determination and— (i)the appeal and any further appeal in relation to the determination has been decided or has otherwise ended, and (ii)the time for appealing against the result of the appeal or further appeal has ended without another appeal having been brought.” (a)the purposes of journalism; (b)academic purposes; (c)artistic purposes; (d)literary purposes... (a)the personal data is not being processed only for the special purposes; (b)the personal data is not being processed with a view to the publication by a person of journalistic, academic, artistic or literary material which has not previously been published by the controller. (a)the period for the controller or the processor to appeal against the determination has ended without an appeal having been brought, or (b)an appeal has been brought against the determination and— (i)the appeal and any further appeal in relation to the determination has been decided or has otherwise ended, and (ii)the time for appealing against the result of the appeal or further appeal has ended without another appeal having been brought.”

[23]Schedule 16 of the DPA 2018 sets out the relevant legal requirements and procedure in relation to the imposition of a penalty. This includes a two-stage process, the first stage of which is for the IC to issue a Notice of Intent to which the subject has the right to make written and, if the IC considers it appropriate oral, submissions. The second stage is the issue of the MPN, which gives rise to the statutory appeal right set out in section 162. For the purposes of the Preliminary Issue, we are not considering the level of the penalty, but rather whether the MPN itself is lawful. However, TikTok raised some points in its submissions about Schedule 16, with which we deal below, so we include this for completeness. The evidence James Stafford

[24]TikTok called one factual witness, Mr James Stafford, the current Global Head of Content for TikTok. He joined TikTok in November 2020, after the Relevant Period. Mr Stafford gave evidence amongst other things about the Platform and TikTok’s mission statement, how TikTok works in terms of content creation and engagement and its role in relation to both of these. His witness statement included the following points, which summarise the key aspects of his evidence: “TikTok’s processing is for creative artistic purposes, just as a commercial online newspaper processing personal data to deliver the news must (one assumes) be processing that data for journalistic purposes, irrespective of the facts that:(a) it is doing so for profit; and

(b) it may be funding its operations through the use of targeted advertising” (Paragraph 29). “prior to early 2019, TikTok did not conduct targeted advertising in the UK and advertisers were unable to target any advertisements to UK users...without the availability of the TikTok for Business platform [he says this was launched in early 2019]...it was not possible for advertisers to serve targeted advertisements on the basis of more specific user attributes such as age, gender or their previous activity or behaviour on the Platform...Once TikTok for Business was launched, advertisers were able to run a limited form of targeting advertising campaigns on TikTok for UK users...the targeting options available to advertisers on TikTok for Business during the Relevant Period were significantly more limited than they are today” (Paragraph 34). “What made TikTok distinct, certainly during the Relevant Period, was that TikTok was designed to both enable and inspire visual and audible creative expression and the generation and sharing of creative UGC [user generated content]” (Paragraph 42).

[25]Mr Stafford was also cross-examined in the hearing by Mr Facenna. Mr Stafford accepted the proposition that TikTok was during the Relevant Period an entertainment platform based on short-form mobile videos (with a maximum length of 60 seconds) but said that there were additional types of content now that did not exist in the Relevant Period. He also accepted that TikTok was a commercial entity and in the Relevant Period the main way of TikTok generating revenue was from advertising but said that there were now other sources of revenue.

[26]He stated that TikTok’s platform and tools were set up to encourage creating rather than just consuming content. However, while he accepted that not all content on TikTok is artistic and there was no concept of artistic expression in the way the content recommendation system worked, he stated that there was encouragement to be creative. TikTok’s systems were not programmed to identify particular types of expression that may be art, but when videos were evaluated by the recommender system, they were focused on whether creative tools on TikTok had been used in creating the content, as around 90% of the content had been created in-app.

[27]Mr Stafford accepted that the processing of data which TikTok does is the same for any “user side experience”, whether or not the content is artistic. At the time when TikTok for Business commercial advertising service was launched in summer 2019, the only information which TikTok had was focused on things like country, operating system and limited contextual markers about the users such as the type of video they were watching; during the Relevant Period it was not building up extensive information about behavioural data of users, so its ability to target advertising was limited.

[28]He described the operation of the platform as having users on one side and content on the other, with the recommender system “matchmaking” between them as it tries to understand users and context preferences.

[29]Mr Stafford explained that the verification of the age of all users was important; and that this requires the processing of data. He accepted that under-13s are not meant to be on TikTok.

[30]Mr Facenna distilled four points which he said the Tribunal could take from Mr Stafford’s evidence, namely:

[31]TikTok was involved in online advertising in the relevant period. In support of this, Mr Facenna referred to a letter from TikTok to the IC dated 19 February 2020 which said at paragraph 9 “TikTok is in the business of providing a free service to users based largely on an advertising business model like many other online services today and, where it has user consent to do so, personalises the user’s experience by personalised advertising”;a. that advertising involved processing of user data. Mr Facenna noted that Mr Stafford had said in his evidence “Someone who was watching make up videos you could target them with a beauty ad for example.”;

b. such processing materially overlapped with processing done by TikTok in delivering video content. Mr Stafford acknowledged that the user’s content history could be a signal for both content and advertisements provided to the user; and

c. in delivering video content there was no particular focus on or priority given to artistic content. Mr Stafford acknowledged that Tiktok’s creative tools can be used for both artistic and non-artistic content.

[32]Whilst Mr Stafford was clearly doing his best to assist the Tribunal, we found his evidence to be of limited assistance for the purposes of the Preliminary Issue given that he had no personal experience and only limited second-hand knowledge of the operations of TikTok during the Relevant Period. To the extent that we found his evidence helpful, we discuss the salient points below. It may be that in due course aspects of his evidence will be more relevant to and assist further with the substantive matters in issue in this appeal. Professor Catherine Abell

[33]TikTok also relied on the expert evidence of Professor Catherine Abell, Professor of Philosophy of Art and Fellow of Queen's College at Oxford University, whose evidence is discussed further below in the context of the construction issue. Professor Abell attended the trial, but the IC chose not to cross-examine her.

[34]Professor Abell’s report dealt with two issues, namely:a. Whether content that was created and then shared or interacted with on the TikTok platform during the period with which the MPN is concerned is artistic in nature (Abell issue 1); and

b. Whether TikTok itself contributes to the creation and consumption of artistic content through the operation of the TikTok platform (Abell issue 2).

[35]In relation to Abell issue 1, Professor Abell outlined several criteria which can be used to assess whether something is art or not and gives examples of how these may be met in the context of TikTok’s Platform. She explained at paragraph 60 that “the criteria I provide below do not purport to provide either necessary or sufficient conditions for being art. Instead, they identify features that artworks commonly exhibit, none of which is either necessary or sufficient for being an artwork, but which nevertheless can be used as a practical test for determining whether or not something is art.”

[36]The most important criterion is that of something being produced with an intention to make art. Professor Abell says that evidence of a TikTok video being made with this intention might include for example:a. Hashtags suggestive of art eg #art; or

b. The maker describing themselves in their bio as an artist

[37]The remaining criteria proposed by Professor Abell are as follows:a. Having been produced by using a medium in a way that exhibits a high degree of skill;

b. Having been produced by using a medium in a creative or original way;

c. Realising positive aesthetic properties;

d. Engaging an audience intellectually;

e. Being expressive of emotion; and

f. Conveying meaning.

[38]Professor Abell raised the question of under what conditions the consumption of TikTok videos constitutes the consumption of artistic content. This appears to miss the point somewhat in our view, because the Preliminary Issue is concerned narrowly with how TikTok processes the data of those users.

[39]She concluded that having reviewed the Top 100 videos during the Relevant Period, 48 either constitute art or represent art when applying her criteria, with a further 3 possibly doing so, but in relation to which she was not able to reach a firm conclusion. She confirmed at the hearing that her assessment of whether a video was art encompassed both where the video itself was artistic and/or the content (ie subject matter) of the video was artistic.

[40]In relation to Abell issue 2, at paragraphs 109-110 she considered under what conditions the consumption of TikTok videos constitutes the consumption of artistic content. She made the following comments:

“It undoubtedly does so when the TikTok videos consumed are themselves art. In addition, it does so when the TikTok videos consumed depict artworks in a way that provides consumers of the TikTok video in question with an experience that is similar to direct perceptual experience in the relevant sense modality or modalities. This is so even when the TikTok in question is not itself art. In some cases TikTok videos provide viewers with an indirect means for accessing their subjects. ...Consuming the video constitutes the consumption of artistic content because (i) the video provides viewers with a visual experience that is similar to that which they would have if they themselves were to walk around the sculpture in the gallery and (ii) the sculpture is a visual artwork. Likewise, consuming a video of a musical performance constitutes the consumption of artistic content so long as the video provides viewers with an auditory experience that is sufficiently like that which they would have themselves if they perceived the performance directly, because musical performances are to be appreciated aurally. If a TikTok video of a painting dramatically distorted the look of the painting so that the TikTok no longer provided consumers with a visual experience which is sufficiently like that which they would have if they saw the painting face-to-face, consumption of the video would not constitute the consumption of artistic content.”

[41]She concluded at paragraphs 130-131 “TikTok’s Creative Features play a very significant role in enabling the creation of art on the platform. They enable users to create videos that qualify as art from recorded videos that would not qualify as art in their own right. In my view, the extent of TikTok’s contribution to the creation of art on the platform is not undermined by the fact that it also has a commercial purpose or motive. Artists often create artworks for artistic as well as commercial purposes and artistic media often have commercial as well as artistic applications...Furthermore, there is commonly a range of parties involved in the production, promotion and sale of artworks (e.g. galleries, exhibitors, auction houses, art publishers) all of whom have both an artistic purpose in making available and disseminating artistic works to those who wish to consume them for artistic purposes and a commercial purpose in generating revenue from those activities. Indeed, fulfilment of their commercial purposes may often depend on their successfully fulfilling their artistic purposes.”

[42]We found the evidence of Professor Abell to be of limited assistance in relation to the Preliminary Issue before us. While one of the key issues we needed to address was whether the data processing was for artistic purposes, we found that Professor Abell’s evidence was focused more on whether the content on TikTok was itself artistic, than on the purposes for which personal data was being processed, which she stated fell outside her expertise. Accordingly, we placed only limited weight on the evidence of Professor Abell. Professor Jan Krämer

[43]The IC did not call any witnesses of fact. He relied on the expert evidence of Professor Jan Krämer, Professor of Information Systems at the University of Passau, Germany, where he holds the Chair of Internet & Telecommunications Business. Professor Krämer was cross-examined by Ms Proops and his evidence is discussed further below in the context of the processing issue.

[44]Professor Krämer was asked by those instructing him to provide an opinion on the extent to which social networks, and in particular TikTok, process the personal data of users and account holders in order to deliver personalised advertising and what such processing entails. He summarised his conclusions at section 4 of his report as follows:

“TikTok's business model relies significantly on targeted advertising and, in my opinion, the promotion and growth of TikTok's advertising business provides a strong commercial incentive that likely shapes the design of TikTok’s service...TikTok’s business model, which to me appears to be focused on selling targeted advertisements, provides TikTok with strong incentives to collect as much personal data about its users as possible, but also...it induces TikTok to displace and demote original user-generated organic content on the platform in favour of showing ads and advancing its advertising business. TikTok collects significant amounts of personal data, which is required for effective and efficient provisioning of targeted ads. In principle, there is no type of data that, either explicitly provided by users, or implicitly revealed through user behaviour, TikTok would not collect and process. Generally, personal data is collected for two purposes, i.e. to serve targeted advertisements and to display personalised content. However, the data feeds into different and distinct types of data processing for the two purposes, respectively, and some processing of personal data occurs exclusively for the advertising purpose....in my opinion processing and collecting data for the purpose of feeding users personalized content, which proves to be significantly more engaging for users, is also conducive to increasing TikTok's advertisement revenues, as engaging content keeps users linger on TikTok’s platform, and thereby enables TikTok to show more ads. Data is collected and processed, and consent is obtained, in the same way and to the same extent from all users, including any children under the age of 13 that were on the TikTok platform in the Relevant Period. In my opinion, personal data is likely not only collected for account holders, but also for the significant number of users that use the platform without having a registered account.”

[45]In his oral evidence Professor Krämer said that he was not familiar with the term “information society service”. He accepted that he had never worked for a platform and was not an expert in the delivery of art content, but that his experience was in working on recommender systems and he has published in the area of online intermediary services. He said his expertise was on academic research into the commercial, economic and regulatory aspects of such services. He accepted that he has not specifically researched or published on TikTok.

[46]He emphasised the interrelationship between a video sharing service and advertising and how one can negatively impact on the other, which he inferred from press articles and TikTok's moderation guidelines. He noted the similar appearance of adverts and organically created content. He observed that TikTok has an incentive for users to create content and stay on the platform as long as possible.

[47]He was questioned about the difference between TikTok and other intermediary services such as Facebook and Google. He accepted that Google’s search engine was not a directly comparable service to TikTok’s platform but said that he did not see any material difference between how the recommender systems of other social media such as Instagram and those of TikTok operated. He maintained that TikTok was, in his view, a social media platform. The Construction Issue

[48]We heard from both parties at length in oral and written submissions about section 156, its purpose and how it should be construed. The key issues raised were as follows:a. The legislative history of section 156 and what it was intended to achieve;

b. Whether it matters that TikTok was a commercial entity;

c. Whether section 156 can apply to an internet service provider (ISP);

d. The interaction between section 156 and section 174, including whether the processing needs to be only for the special purposes to fall within section 156(1);

e. The interaction between section 156 and

Article 10 of the ECHR

. General points about statutory interpretation

[49]The IC summarised in his skeleton argument at paragraphs 48 to 50 the general principles of interpretation which should be applied and these were not disputed by TikTok. He said:

“In Spath Holme, R (Spath Holme Ltd) v Secretary of State for the Environment, Transport and the Regions [2001] 2 AC 349 Lord Nichols explained that “statutory interpretation is an exercise which requires the court to identify the meaning borne by the words in question in the particular context.”

Speaking extra-judicially, Lord Burrows summarised the approach as follows:

“[T]here is only one correct modern approach – that one must ascertain the meaning of the words in the light of their context and the purpose of the provision. Lord Burrows, Sir Christopher Staughton Memorial Lecture 2022, 24 March https://www.supremecourt.uk/docs/sir-christopher-staughton-memorial-lecture-2022.pdf). ”

In R (Quintavalle R (Quintavalle) v Secretary of State for Health

[2003] UKHL 13

[2003] 2 AC 68

), ] Lord Bingham held that “the basic task of the court is to ascertain and give effect to the true meaning of what Parliament has said in the enactment to be construed. … The court’s task, within the permissible bounds of interpretation, is to give effect to Parliament’s purpose. So the controversial provisions should be read in the context of the statute as a whole, and the statute as a whole should be read in the historical context of the situation which led to its enactment.” To similar effect, in R (Black) R (Black) v Secretary of State for Justice

[2017] UKSC 81

[2018] AC 215

, §37(3)-(4). Lady Hale emphasised that “the goal of all statutory interpretation is to discover the intention of the legislation … That intention is to be gathered from the words used by Parliament, considered in the light of their context and their purpose.” In PACCAR R (PACCAR Inc & Ors) v Competition Appeal Tribunal & Ors

[2023] UKSC 28

at §§40-41. the Supreme Court reiterated that “there are numerous authoritative statements in modern case law which emphasise the central importance in interpreting any legislation of identifying its purpose.” The IC in oral submissions emphasised that this purposive approach is the most important principle in relation to construction in this context. In R (Quintavalle To similar effect, in R (Black)

The legislative history of section 156 and what it was intended to achieve

[50]Both parties made extensive submissions about the legislative history of section 156 and what it was intended to achieve, taking the Tribunal through the GDPR, DPA 1998 (in which the wording of section 46 is substantively identical to section 156 of the current DPA), DPA 2018 and the 1995 and 2015 Directives.

[51]It is common ground that section 156 and section 174 form part of a suite of special purposes provisions enacted within the DPA 2018 to implement article 85 of the GDPR. Article 85(1) provides “Member states shall by law reconcile the right to the protection of personal data pursuant to this Regulation with the right to freedom of expression and information, in including processing for journalistic purposes and the purposes of academic, artistic or literary expression.” Article 85(2) provides that “For processing carried out for journalistic purposes of the purpose of academic, artistic or literary expression, Member States shall provide for exemptions or derogations from [the relevant chapters] if they are necessary to reconcile the right to the protection of personal data with the freedom of expression and information.”

[52]Ms Proops made the point in her closing submissions that there is no hierarchy between the various special purposes, such that journalism is more important than art, for example. We agree with this; the special purposes as defined in the statute do not give more weight to one form of purpose than to another. Ms Proops further noted in her skeleton argument that TikTok says section 156 “is potentially important not only for the protection of third party fundamental free expression rights but also for the protection of free expression rights of the very data subjects whose interests the ICO purports to be protecting through its enforcement actions. This is because a particular data processing operation may at one and the same time engage the data subject’s data protection rights and their fundamental free expression rights”.

[53]Mr Facenna argued in his opening submissions that Section 156 is not the type of specific exemption which is mandated under GDPR article 85(2). It is a reconciliation by Parliament of the competing rights under article 85(1). In section 156 (which simply replicates with no material difference what was in section 46 of DPA 1998 This is confirmed in the explanatory notes to the Data Protection Act 2018, paragraph 431 ), Parliament seeks to reconcile the data protection rights under GDPR and the competing fundamental rights in relation to journalistic processing and so on by creating a specific procedure to be followed for regulatory enforcement action by the IC in respect of processing of personal data which has taken place for the specific identified forms of expression; so journalistic, artistic, literary and academic. Parliament was also concerned to make sure that data protection laws did not become a restraint on the publication of new material in the context of artistic, academic and journalistic expression.

[54]He took the Tribunal to the Court of Appeal case of Stunt v Associated Newspapers Ltd (Information Commissioner intervening)

[2018] 1 WLR 6060

. At paragraph 92 he noted that the Court of Appeal summarised what it said Parliament had in mind when giving effect in DPA 1998 to Article 9 of the 1995 Directive and reconciling data protection privacy rights with freedom of expression. He also referred to the parliamentary material annexed to the decision in Stunt at Appendix 2 and in particular paragraph D which describes what ended up in the DPA 1998, including clause 45, which became section 46 (and later section 156 of DPA 2018), as “a careful set of checks and balances”.

[55]Mr Facenna argued that this made the legislative intention and Parliament’s intentions in relation to the provision which ultimately became section 156 clear. What Parliament was really concerned with was to strike a careful balance in relation to what appeared to be the driving concern which was to protect the ability of those using personal data directly in their journalism in particular, but also in entertainment programmes and other forms of artistic broadcasting and so on, to ensure that they could be able to do so without the risk of the data protection rights laid down in DPA 1998 cutting across that. He added that Parliament has done the Article 8/Article 10 balancing exercise required under what is now Article 85 of the UK GDPR, and it has opted for the arrangement set out in section 156. Accordingly, it is not the task of the Tribunal to second guess Parliament's decision as to where the right balance should be struck between data protection rights and freedom of expression that involve processing of personal data, because Parliament has already struck that balance in the legislation. Nor is it the Tribunal’s role to directly apply Article 85 UK GDPR; it is applying a domestic statutory provision that was enacted by Parliament to strike the right balance between competing rights in the UK context. (Ms Proops appeared to agree with this, as in her closing submissions she said that Parliament has sought to strike the balance between these conflicting fundamental rights in the context of MPNs by enacting section 156 and confirming that there is “no challenge to the legality of the way that the balance has been struck in section 156”.)

[56]He contrasted the wording of section 156 with the more specific exemption in paragraph 26 of Schedule 2 of DPA 2018 (AB31) which imports a prejudicial consequences type test and is distinctly different from section 156.

[57]We were persuaded by Mr Facenna’s arguments in relation to Parliament’s intention and found the extracts to which he took us from Hansard helpful and persuasive in understanding the balancing exercise undertaken by Parliament. We agreed on the basis of this evidence that Parliament had decided in enacting DPA 2018 exactly how it wished to balance the competing rights in play, including

Article 10 ECHR

. We therefore agreed with the IC that it was not for the Tribunal to second-guess this balancing exercise.

Whether it matters that TikTok was a commercial entity

[58]In opening, Ms Proops observed that Section 156 imposes no requirement concerning the character of the controller; it does not provide that the controller must be a journalist, artist or particular type of publisher. Instead, as its language suggests, section 156 is concerned simply with the character of the processing and whether the processing is itself for the special purposes. She argued that the CJEU had in the case of Satamedia Tietosuojavaltuutettu v Satakunnan Markkinaporssi Oy (Case C-7307) [2010] All ER(EC) 213 made it clear that a wide approach fell to be applied in respect of special purposes concepts and also made clear that the fact that a controller is a commercial entity operating for profit providing the service for profit, does not preclude the relevant processing being for special purposes. She said that TikTok has never disputed that it is a commercial user.

[59]At paragraph 43-44 of TikTok’s skeleton argument, it made the following points: “the suggestion that relevant processing cannot be “for the special purposes” where it is undertaken for profit is contrary to authority: see Satamedia CJEU, where, as noted above, the CJEU went so far as to conclude that processing could be “solely for the special purposes”, despite being undertaken for profit-making purposes...To treat a controller’s profit motive as determinative (or even relevant) to the application of the special purposes regime would drive a coach and horses through that regime. It is very clear that, consistent with Article 10 and the CJEU’s judgment in Satamedia CJEU, Parliament did not intend the fact that the controller was driven by commercial imperatives to affect whether or not they fall within the scope of the special purposes regime”.

[60]We agree that the fact that TikTok was a commercial entity does not mean that it cannot be found to be processing personal data for special purposes within section 156. Whether or not the data processor is a business does not matter for the purpose of construction, and this is underlined by the fact the statute is silent on this point. It is, however, crucial to determine as a matter of fact the processing to which the MPN relates before applying the special purposes derogation.

Whether section 156 can apply to an internet service provider (ISP)

[61]Ms Proops argued that it is well established in the human rights jurisprudence that Article 10 free expression rights are treated as being intensively engaged in the case of online platforms hosting third party content. Such platforms both invite and then enable free expression at scale. They potentially give voice to an extremely large number of individuals. Online platforms play an important role in effectively democratising speech, meaning that platform services such as TikTok themselves exercise weighty free expression rights as and when they deliver their platform services to their users. In order for section 156 to be engaged, the processing which the platform undertakes must still be for the special purposes and go beyond being a service that merely enables free expression. She argued that it cannot be right that as a matter of principle a platform service is treated as automatically excluded from the ambit of section 156 simply because it does not itself generate special purposes content but instead encourages and enables others to engage in special purposes expression.

[62]Ms Proops also argued in her oral submissions that where dealing with a service provider such as TikTok in the context of the provision of the TikTok service to its users, a service that is fundamentally oriented to the achievement of artistic expression, it is very clear that Article 10 operates in those circumstances to afford TikTok extremely weighty Article 10 rights, rights that may only be interfered with in circumstances where there is pressing need to do so. Put simply it must follow that section 156 applies to a service like TikTok. She relied on the case of NT1 where she said that it was accepted that a third party which facilitates or supports the dissemination of journalistic content but did not itself create such content could be processing personal data for the special purposes.

[63]In its skeleton argument, TikTok stated at paragraph 45:

“there is no principled basis for excluding intermediary service providers such as TikTok as a category of controller from the ambit of s. 156, merely because they do not generate or edit the content which they intermediate.”

[64]Mr Facenna confirmed in his opening submissions that the IC is not saying that no online platform, including TikTok, can ever rely on section 156. His case is rather that processing that is generally undertaken by online hosting platforms like TikTok in delivering their service is not what section 156 was aimed at when Parliament was devising it. He therefore argued that the Tribunal does not need to go so far as to say whether TikTok or platforms like it could or could not ever come within section 156. Section 156 raises a fact-specific question whether the processing in issue in any particular time was for the special purposes. It has nothing to do with the sector in which a business operates or what the nature of the business is overall; it is about the processing to which the penalty notice relates.

[65]In the IC’s skeleton he explained his position on this further at paragraphs 82-91:

“82. TikTok’s position is that “free-expression platforms” (which, given the breadth of the concept, would include not only TikTok but all other online platforms, blogs, websites etc. that host any potentially journalistic, artistic, literary or academic user-generated content) have “special protections under the legislation”

. TikTok argues that this is necessary because the normal enforcement of data protection law by the statutory regulator could affect how users on those platforms access, use and express themselves online. 83. If that were the effect of s. 156 then, far from being a limited derogation necessary to protect fundamental rights of free expression exercised for specific purposes, it would be a provision that fundamentally alters the whole regime of regulatory enforcement by the [IC]. Rather than the [IC] acting as a statutory regulator with direct powers subject to supervision by the tribunal and courts, regulatory activity would be subject to ex ante judicial oversight in respect of any data controllers whose activities involve the provision of a platform for the publication or dissemination of third party content that might (or might not) include creative, academic or journalistic output. 84. In practice, TikTok’s argument is that Parliament legislated to limit the [IC] from regulating the data processing activities of many of the world’s largest companies and data controllers (e.g. Meta / Facebook, TikTok, X (Twitter) and Google / YouTube, among others). The implication is that the [IC] must first apply to court for permission to regulate those platforms in any individual case – a process necessarily involving significant delay and cost, given the resources of the parties in question and the likelihood of appeals. 85. That interpretation is not in accordance with the clear – and limited – wording and purpose of s. 156 DPA. There is nothing in the history of s. 156 to suggest that internet platforms hosting third party content, such as TikTok, were within Parliament’s contemplation when enacting the provision. Rather, the balance struck by Parliament focuses on the purposes of the specific processing being regulated. While users of platforms such as TikTok may be exercising free expression rights on that platform, it does not follow that the platform as a whole, and all of the data processing which underlies the commercial operation of the platform, thereby falls outside the scope of the ordinary regulatory regime and may only be regulated with ex ante permission of the Court in accordance with s. 156. 86. As the [IC] found in the MPN, TikTok’s processing of personal data is automated and does not distinguish between (i) user-generated content that constitutes journalistic, academic, artistic or literary material, and (ii) user-generated content which does not constitute such material (MPN paragraph 174(b)). The system is blind to what it is processing. TikTok therefore lacks the level of control, including editorial control, over the content on its platform that would be needed to say that it was processing for its own special purposes (see MPN paragraph 165-173). A child using TikTok may see journalism or art but may also see advertisements for video games or lip-gloss, or more harmful content. The fact that some users may publish journalistic, academic, artistic or literary content on the platform, causing TikTok to process personal data in connection with that content, is incidental to the platform’s commercial purpose, which is to display content in a way that is conducive to achieving TikTok’s commercial ends. As with Google, for TikTok the special purposes are “purely accidental, and incidental” to its actual purposes (NT1 at paragraph 100). There are no special purposes inherent in TikTok’s processing per se. 87. The language, context and purpose of s. 156 is not apt to cover the commercial and technical processing activities of an online platform that merely provides support for, or facilitates, others engaged in producing e.g. artistic content or journalism. By the time the DPA was enacted, social media platforms were well established, and no express provision was made for them by Parliament. There is nothing to indicate that Parliament intended such platforms to benefit from a wide carve out from the regulatory regime, or that Parliament was concerned about the impact of data protection law on such platforms in the same way as it was concerned about, e.g. impact on freedom of the press. Parliament appeared to have in mind controllers processing for their own special purposes (the most obvious example being the press), not third-party platforms who may facilitate access to such materials on an incidental basis. 88. TikTok’s approach would create an unworkable regime of prior judicial supervision of data protection regulation, dragging the Court pre-emptively into innumerable regulatory disputes, and hampering the efficient enforcement of data protection law against online platforms. It would be a significant departure from Parliament’s choice of an administrative, and not prosecutorial, model, for regulatory enforcement in the field of data protection. 89.. If the law is to be extended to cover all aspects of the [IC’s] enforcement work against online platforms, that extension should be made by Parliament, following proper legislative deliberation and consultation – not by TikTok asking the Tribunal to extend the scope of s. 156 beyond the boundaries of the ordinary meaning of its language, and Parliament’s clearly expressed purpose in enacting it. 90.Moreover, such an interpretation would have wider consequences beyond the enforcement of the UK GDPR by the [IC]. On TikTok’s interpretation, much or all of its processing of personal data would benefit from paragraph 26 Schedule 2 DPA (the “Special Purposes Exemption”), which could disapply UK GDPR provisions, including the data protection principles in Article 5 UK GDPR, based only on TikTok’s reasonable beliefs about the public interest and impact on the special purposes. This could apply, for instance, in a private law claim brought by an individual data subject against TikTok.23 The impact of such an interpretation would extend well beyond TikTok; it could pave the way for many of the world’s largest companies and data controllers to rely upon the Special Purposes Exemption to seek to bypass various of the safeguards contained within the UK GDPR, and/or to limit regulatory oversight and enforcement in much wider ways than Parliament could have envisaged. 91. There are important public interests, consumer and fundamental rights at stake and, in the absence of evidence that Parliament intended to legislate in the manner TikTok suggests, the Tribunal should interpret and apply s. 156 as the narrow and specific derogation it is. “

[66]Mr Facenna noted in his closing submissions that there is nothing in the domestic or the European legislative history which supports TikTok's basic argument that the purpose of the provisions is to disapply the normal enforcement of data protection law for an online platform, simply on the basis that the platform enables or even that it encourages its users to exercise their own individual freedom of expression. The fact that we may, in a broad sense, be within Article 10 territory, does not mandate a broader reading of the derogation nor the statutory provisions.

[67]It appears to us that, contrary to TikTok’s assertions, the IC is not trying to say that section 156 can never apply to an ISP like TikTok as a matter of principle. Rather, his position is that whether section 156 applies is fact-specific and concerns the actual processing with which the MPN in question is concerned. Whilst it may have been the case that the internet was in its infancy at the time of the 1995 Directive, GDPR and DPA 1998 and so the specific application of data protection may not have been explicitly considered by the legislature, it is obvious that that was not the case at the point at which DPA 2018 was drafted. By then ISPs were firmly part of the data protection landscape, so if Parliament had intended to make specific exclusion of them, it would have done so at that stage.

[68]We agree that in order to determine whether the special purposes apply in a particular set of circumstances it is necessary to consider the specific processing which is the subject of the MPN. It is this factual context which determines whether or not section 156 is engaged.

[69]We agree with the IC that Parliament did not intend section 156 to apply any differently to ISPs to the way in which it applies to other data processors. If it wished there to be a difference in how the statute should apply, that would be a matter for Parliament, not for the Tribunal. Accordingly, we accept that section 156 can apply to an ISP. The interaction between section 156 and section 174, including whether the processing needs to be only for the special purposes to fall within section 156(1)

[70]Both parties also made submissions about the interaction between section 156 and the special purposes set out in section 174. This encompasses the protections which these sections provide and also the question of whether processing needs to be only for the special purposes if it is to fall within section 156(1).

[71]TikTok said the following at paragraphs 18-23 of its skeleton argument:

“18. Sections 156 and 174 are part of a wider scheme in the DPA 2018 aimed at reconciling data protection law with ECHR Art 10. Thus, where ECHR Art 10 rights are significantly involved; there are also restrictions on the issuing of Information Notices (s.143 (1)), Assessment Notices (s.147(5)) and Enforcement Notices (s.152(1)), and Schedule 2, para 26 provides wide-ranging (but necessary) exemptions from the duties that would otherwise apply to a controller processing personal data for the special purposes. 19.The predecessor provision to paragraph 26 of Schedule 2 to the DPA was s. 32 of the Data Protection Act 1998 (“DPA 1998”). S.32 of the DPA 1998 was formulated in a way which precluded its being applied save where the controller was processing personal data “only for the special purposes”

. That limiting requirement does not appear in paragraph 26. The UK GDPR has thus enhanced the protection for Article 10 rights in cases involving processing for the special purposes. This also means that principles approved in judgments addressing the application of s. 32 DPA 1998 are likely to be of limited assistance when it comes to determining how the special purposes provisions embodied in the UK GDPR fall to be construed and applied. 20.Importantly, and in common with paragraph 26 of Schedule 2 to the DPA, s. 156 does not impose any limiting requirement to the effect that the relevant processing must be only for the special purposes. The issue is simply whether the processing in issue is “for the special purposes”. It necessarily follows that Parliament made a deliberate legislative choice to the effect that s. 156 could apply where a controller was processing data for multiple purposes, provided merely that one of those purposes was a special purpose. 21. It is also important to note in this context that s. 156 does not create a binary outcome whereby, if it is a special purposes case, the ICO cannot issue a monetary penalty notice. Instead, it erects a carefully calibrated scheme whereby: (1) the ICO cannot issue a monetary penalty notice where the processing in issue is both (a) only for the special purposes and (b) with a view to the publication of previously unpublished special purposes material (because in these circumstances the ICO cannot issue any determination under s. 174(3)), but in all other special purposes cases, the ICO’s powers to issue a monetary penalty notice are conditioned, such that it can issue a monetary penalty notice but only where the procedural hurdles set by s. 156 have been cleared. 22. Those latter hurdles are clearly designed and intended by Parliament to ensure that the ICO proceeds in a suitably careful and considered manner when dealing with special purpose processing, and with the court exercising an important supervisory role. 23. Further, s.156 is potentially important not only for the protection of third party fundamental free expression rights but also for the protection of free expression rights of the very data subjects whose interests the ICO purports to be protecting through its enforcement actions. This is because a particular data processing operation may at one and the same time engage the data subject’s data protection rights and their fundamental free expression rights. This will certainly be true for example where, as in the present case, an intermediary service provider is engaged in a form of data processing aimed at enabling special purposes activities on the part of its users. The aim of s. 156 is to ensure that protection is afforded in respect of such processing across the board, including where (as here) the fundamental free expression rights in issue are being exercised by the data subjects.” (1) the ICO cannot issue a monetary penalty notice where the processing in issue is both (a) only for the special purposes and (b) with a view to the publication of previously unpublished special purposes material (because in these circumstances the ICO cannot issue any determination under s. 174(3)), but in all other special purposes cases, the ICO’s powers to issue a monetary penalty notice are conditioned, such that it can issue a monetary penalty notice but only where the procedural hurdles set by s. 156 have been cleared.

[72]Ms Proops said in opening that Section 156 does not operate to altogether exclude the IC's ability to take enforcement action in respect of the processing in issue. Instead, along with the identically framed section 152 which embodies restrictions on the ICO's powers to issue enforcement notices, what section 156 does is condition the way in which the ICO's enforcement powers are exercised, to ensure they are held in a proper balance with the relevant free expression rights in play. She argued that Parliament has taken the view in enacting section 156 that the existence of that ex post facto protection is not sufficient in a case involving processing for the special purposes and that an additional ex ante level of protection for special purposes processing is required.

[73]Ms Proops argued that Section 156 does not say that the notice must be given with respect to processing for the special purposes or that the notice must be given with respect to processing that is only for the special purposes. She contrasted this with certain provisions of DPA 2018 which only apply where the processing in issue is for the special purposes, such as section 174(3). She noted that this legislative choice of wording reflects Parliament's desire to ensure that section 156 was sufficiently widely drafted that it could encompass penalty notices concerning processing, which is in effect for multiple purposes, provided that one of those purposes was the special purposes.

[74]Ms Proops said that TikTok accepted that during the Relevant Period it will inevitably have processed content that was not special purposes content. However, it was the processing of non-artistic content that was incidental to the larger purpose of enabling artistic expression. She also said at a different juncture that the CJEU had in the case of Satamedia Tietosuojavaltuutettu v Satakunnan Markkinaporssi Oy (Case C-7307) [2010] All ER(EC) 213 made it clear that a wide approach fell to be applied in respect of special purposes concepts

[75]In relation to the conditions which sections 156 and 174 impose on the exercise of the IC’s enforcement functions, Ms Proops argued it will offend against the statutory scheme in s.156 if the Tribunal finds that a service like the TikTok service is out of scope of that provision. She argued that the logical consequence was that the ICO could issue an enforcement notice requiring TikTok, in effect, to shut down the service by requiring it to stop processing all the personal data to deliver the service. Section 152 (which she said was identically framed to section 156) could not come into play in that scenario, because - on the IC’s case - it is not a special purposes processor. She argued that NT1 positively supports TikTok's case on this point because it makes clear that the focus should be on the larger purpose of the processing and it says the special purposes provisions must be treated as applying to those who facilitate the special purposes expression of others.

[76]In its skeleton argument, TikTok noted that the case of NT1 was concerned with section 32 of DPA 1998, where there was a different test to that set out in s.156. In NT1, Warby J decided that, on the facts of the case before the court, Google did not meet the “only for the special purposes” test because it offered a wholly indiscriminate intermediary service, such that “whatever the nature of the search in question, when Google responds to a search on an individual’s name by facilitating access to journalistic content about [an] individual, this is purely accidental, and incidental to its larger purpose of providing automated access to third party content of whatever nature it may be, that it has identified and indexed and meets the search criteria specified by the user”. TikTok went on to argue this indicates that “the overall design of the service and the outcomes it produces in practice are likely to be key in resolving the question of whether the processing undertaken for the purposes of delivery of the service engages s.156”

[77]At paragraph 49 of its skeleton, TikTok says “it is wrong to suggest that a service such as the one offered by TikTok cannot attract the protection of s. 156 because it permits content which is not special purposes content to be disseminated. The fact that, as a free expression service, a service such as the TikTok service does not set out to prevent free expression content which is not special purposes content from being disseminated cannot be the litmus test of whether s. 156 is engaged.” It notes the narrow point in NT1 that “an ISP which was processing special purposes content “purely accidentally” and “incidentally” could not claim to be processing personal data only for the special purposes.”

[78]The IC says at paragraphs 53-55 of his skeleton:

“53. S.156 imposes an unusual and exceptional set of requirements derogating from the administrative regime for enforcement of data protection law. Where s.156 applies, the Commissioner must: make a determination under s.174 (itself subject to appeal rights); seek the permission of the court (on notice except in urgent cases); and demonstrate a suspected failure to comply with the law of substantial public importance, before being able to impose a penalty notice. Reflecting the onerousness of that regime, it only applies to processing for the specific forms of free expression identified in recital 153 and Article 85 of the UK GDPR. 54. The purpose of the provisions is clear from the language of Article 85 UK GDPR, ss. 156 and 174 DPA and their predecessor provisions, and from the surrounding legislative material. Their purpose is to provide a specific derogation from the normal enforcement of data protection law and data protection rights, but only where that is necessary to reconcile the fundamental right to the protection of personal data with the freedom of expression exercised for the purposes of journalism, art, literature or academic work. In keeping with this purpose, the derogation is to be interpreted narrowly. 55. There is nothing in the domestic or European legislative history to support TikTok’s argument that the purpose of the provisions is to provide a broad carve-out from the normal enforcement of data protection law for publishers, online or otherwise, simply because some people may use the platform to publish material in exercise of their own individual freedom of expression. Such an expansive derogation would be neither necessary nor proportionate in the sense required by Article 85 UK GDPR.”

[79]He goes on to say at paragraphs 56-58:

“56. Turning to the words of s. 156, the statutory regime is triggered by reference to the purpose or purposes for which the processing in question is carried out (“processing of personal data for the special purposes”). This reflects the language of UK GDPR Article 85 (“processing carried out for journalistic purposes or the purpose of academic, artistic or literary expression”). 57. As such, for s.156 to be engaged, the special purpose for which the processing is carried out cannot be unintended or incidental. The legislation could have used wider language such as “in connection with” journalism or artistic expression, but did not do so. To engage the s.156 arrangements, the processing to which the MPN relates must be processing that is carried out “for” the special purposes. TikTok must therefore show that the data processing that is the subject of the MPN was data processing carried out for journalistic purposes or for academic, artistic or literary purposes. 58. .... S.156 may not require that relevant processing be solely for the special purposes; but the processing must be done for the special purposes. A tangential, vague or indirect connection with special purposes does not suffice.”

[80]Mr Facenna said that the purpose underlying section 156 is to alter the normal regime for the enforcement of data protection law by the IC in certain circumstances, specifically to provide additional protection for the processing of personal data for the purposes of journalism or for academic, artistic or literary purposes. These provisions need to be applied in accordance with the Parliamentary purpose. Concepts such as journalism and art can be broadly interpreted, but the purpose of the provision, its scope, is narrow and strict. It only applies to processing of personal data that is for those specific purposes. So it does not include general service delivery processing, or processing that supports the exercise of free expression and it is not engaged simply because a business says that its mission is to encourage its customers to be creative.

[81]Mr Facenna also referred to Stunt at paragraph 68 of that case which says that section 32(4) of DPA 1998 should be given a “purposive and restricted interpretation”. It also noted at paragraph 72 in relation to the stay provisions that they “if interpreted literally would not comply with the requirement in article 9 that members states shall provide an exemption for the processing of personal data carried out solely for journalistic purposes “only if the exemption is necessary” to reconcile the right to privacy with the rules governing freedom of expression.” He argued that this principle should read across to the construction of s.156.

[82]There are several distinct points with which we need to deal with here. Firstly, it is common ground between the parties that section 156 does not require that the processing in respect of which an MPN is given should be only for special purposes. We agree with this; the ordinary and natural meaning of the words in section 156 is that processing must be for the special purposes; there is no statutory restriction in this section requiring that it be exclusively so. We accept Mr Facenna’s submission that had Parliament intended to include wider words such as “in relation to” it would have done so, given that some other parts of the statute do use this wider formulation.

[83]The next question is how closely connected to the special purposes processing must be in order to be “for” the special purposes. As illustrated by the example of a newspaper Mr Facenna gave in submissions (which was disputed by Ms Proops who maintained her argument that the MPN is concerned with the delivery of the substantive TikTok service to users and not concerned in any meaningful way with its commercial revenue generating activities) this is not always straightforward because a data controller may be processing the same data for a number of purposes. The regime in sections 156 and 174 is, in our view, intended to deal with the situation where processing of data might otherwise infringe the law of data protection, but it is necessary to provide an exemption or derogation in order to balance data protection rights with the freedom of expression exercised for the purposes of journalism, art, literature or academic work. So, in the example of a newspaper, publishing an individual’s name and address in the context of a journalistic article on its website would be ordinarily prohibited as a matter of data protection, but a derogation is permitted in the limited circumstances of a journalistic article to protect the press’s free expression rights. Processing that same name and address for the purposes of a subscription for that individual would be subject to ordinary data protection rights because no such journalistic purpose is engaged. We preferred Mr Facenna’s argument because it reflected what appears to us to be the reality that the same data may be processed for a number of purposes, rather than the high-level view TikTok took of saying that all the processing was for service delivering purposes.

[84]The special purposes regime set out in these sections requires an interpretation which is sufficiently narrow to be consistent with the articulation in Article 85 UK GDPR that derogation should be made only where necessary. It will be a question of fact in each specific case as to whether, in the specific circumstances of that case the processing was actually done for the special purposes. We agree that the word “for” connotes a degree of intention; this means that incidental or accidental processing of personal data is unlikely in many situations to be done, for example, for artistic or journalistic purposes. There must, in our view, be more than an accidental or incidental connection to the special purposes for the protections set out in section 156 to apply to the specific processing, but this can only be evaluated properly once it is clear as a matter of fact what the processing to which the MPN relates actually is.

[85]In our view, this requires a narrow and purposive approach to construing section 156. Taking into account all the evidence and the parties’ submissions we do not consider that the fact that TikTok’s stated mission and overall purpose is concerned with the encouraging of creativity and creation of artistic and journalistic content to be sufficient to render all its processing of personal data as being “for the special purposes”. Instead, in order to apply section 156 correctly, we must first establish as a matter of fact the processing concerned and then consider the question of whether it is for the special purposes in that specific context.

[86]This is to be distinguished, in our view, from the broad interpretation of the special purposes themselves envisaged by recital 153 of the GDPR which states “In order to take account of the importance of the right to freedom of expression in every democratic society, it is necessary to interpret notions relating to that freedom, such as journalism, broadly”. We consider that it is perfectly possible to take a broad view of what journalistic or artistic purposes means as done in the Satamedia case and still be narrowly focused on whether the processing in question was for those purposes. We discuss this further below.

The interaction between section 156 and Article 10 of the ECHR

[87]Both parties made oral and written submissions about this aspect of construction. The written submissions were extensive and complex, so we summarise them below.

[88]

Article 10 ECHR

provides:

“1. Everyone has the right to freedom of expression. This right shall include freedom to hold opinions and to receive and impart information and ideas without interference by public authority and regardless of frontiers. This Article shall not prevent States from requiring the licensing of broadcasting, television or cinema enterprises. 2. The exercise of these freedoms, since it carries with it duties and responsibilities, may be subject to such formalities, conditions, restrictions or penalties as are prescribed by law and are necessary in a democratic society, in the interests of national security, territorial integrity or public safety, for the prevention of disorder or crime, for the protection of health or morals, for the protection of the reputation or rights of others, for preventing the disclosure of information received in confidence, or for maintaining the authority and impartiality of the judiciary.”

[89]TikTok argued at paragraph 24 of its skeleton that “data protection law and the right to free expression are in a degree of tension. Sections 156 and 174 DPA 2018 form part of a carefully calibrated statutory scheme to ensure that those tensions are resolved in a manner that complies with the European Convention on Human Rights (“ECHR”), and in particular Article 10”. It makes four points about how the special purposes protections in the DPA 2018 should be approached, as follows: a. Article 10 protects a very broad range of forms of expression. Journalism is protected (see e.g. Axel Springer AG v Germany [2012] EMLR 15 at ¶¶78-81). . So too is artistic expression, and that concept must be understood in a very wide sense: see e.g. Lindon v France 35 at ¶47: (2008) 46 EHRR “A novel is a form of artistic expression, which falls within the scope of Art.10 in that it affords the opportunity to take part in the public exchange of cultural, political and social information and ideas of all kinds. Those who create or distribute a work, for example of a literary nature, contribute to the exchange of ideas and opinions which is essential for a democratic society. Hence the obligation on the State not to encroach unduly on their freedom of expression “ Expression that “offends or shocks” is protected see e.g. Vereinigung Bildender Kunstler v Austria

(2008) 47 EHRR 5

at ¶ 26 (dealing with satire and caricature):

“The Court reiterates that freedom of expression, as secured in para.1 of Art.10, constitutes one of the essential foundations of a democratic society, indeed one of the basic conditions for its progress and for the self-fulfilment of the individual. Subject to para.2, it is applicable not only to “information” or “ideas” that are favourably received or regarded as inoffensive or as a matter of indifference, but also to those that offend, shock or disturb the state or any section of the population. Such are the demands of that pluralism, tolerance and broadmindedness without which there is no “democratic society”

. Those who create, perform, distribute or exhibit works of art contribute to the exchange of ideas and opinions which is essential for a democratic society” . The exceptions to Art 10(1) set out in Art 10(2) must be construed strictly and the need for any restrictions must be established convincingly (Axel Springer at ¶78). b. The rights protected under Article 10 are not confined merely to the right to communicate ideas. As the express terms of Article 10 make clear, they also include the right on the part of individuals to receive that which has been expressed by others. In that important sense, Article 10 reflects both sides of the free expression coin, recognising that the right to impart ideas is likely to be rendered nugatory if not married with a right to receive ideas expressed by others. c. Article 10 protects not just the originators or editors of content, but those who distribute, disseminate, or provide a platform for it. It does so because such service providers effectively enable and amplify the exercise of Article 10 rights, helping to ensure that those who want to freely express themselves are not shouting into the void and that those who want to receive what others are expressing have their ears and eyes opened. This was recognised before the advent of the internet: see e.g. Muller v Switzerland

(1991) 13 EHRR 212

(conviction of organisers of an exhibition who invited artists to use their exhibition space, giving them free rein as to what to exhibit: no breach, but interference required justification under Article 10); Otto- Preminger Institute v Austria

(1994) 19 EHRR 34

(seizure and forfeiture of a film engaged the Art 10 rights of the organisation that was intending to screen it) . In the internet era, the ECtHR has recognised that ISPs can also attract the application of Article 10, and themselves have Article 10 rights see Delfi AS v Estonia [2015] EMLR 26; Tamiz v UK [2018] EMLR 6; Magyar Tartalomszolgaltatok Egyesulete v Hungary (App No. 22947/13; judgment of 02.02.16) and Standard Verlagsgesellschaft MBH v Austria (No.3) (App No 39378/15; judgment of 07.12.21). . The ECtHR recognises that the provision of ISP services where special purposes material can be exchanged attracts a high level of protection under Article 10 Thus, in Tamiz (a case concerning Google’s blogger.com service brought under

ECHR Art 8

by a person allegedly defamed on a blog), the Court said at ¶90: “…having particular regard to the important role that ISSPs such as Google Inc, perform in facilitating access to information and debate on a wide range of political, social and cultural topics, the Court considers that the respondent State’s margin of appreciation in the present case was necessarily a wide one.” . d. Interferences with Article 10 (or “restrictions”) occur not only when the state imposes a penalty relating to the exercise of free expression rights, but at earlier stages as well. Thus, in a criminal case, arrest, prosecution, conviction and sentence are all restrictions that fall to be justified under Article 10(2) DPP v Ziegler

[2022] AC 408

at ¶57. It may therefore be necessary to limit the powers of a regulator to investigate and impose penalties that might interfere with Article 10(1). It may be insufficient to defer consideration of Article 10 until the conclusion of a full merits-based appeal against a penalty. That may fail to offer adequate protection against the interferences that will already have occurred (e.g. through the regulated person taking the precautionary step of restricting or adapting the relevant service in line with the regulator’s expectations pending the outcome of the appeal, for fear that any other action may attract further regulatory censure, or as a result of the time and costs entailed on mounting a full appeal). There will be an interference with Article 10 where the imposition of a penalty is likely to have a “chilling effect”, i.e. deter a person from further exercising their Article 10 rights or exercising them to the same extent See e.g.Lingens v Austria

(1986) 8 EHRR 407

at ¶44. . An interference with Article 10 rights is also likely to result where, in effect, the enforcement action forces the regulated person to change the design/shape of the relevant activity or service; i.e. forcing that person to make different choices about the way they exercise their own Article 10 rights or the way they permit others to exercise their Article 10 rights.

[90]TikTok argued thatthe special purposes regime (including sections 156 & 174) must be interpreted and applied in accordance with

ECHR Art 10

. This means that:a. Each of the “special purposes” – which are not defined in the legislation beyond s. 174(1) - must be construed broadly see further on this issue the judgment of the CJEU in Tietosuojavaltuutettu v Satakunnan Markkinaporssi Oy (

Case C-73/07

) [2010] All ER (EC) 213 (“Satamedia CJEU”) which makes clear that “notions relating to” the Article 10 right to freedom of expression, “such as journalism”, should be construed “broadly” (¶56); see to like effect the judgment of Sharp LJ in Stunt v Associated Newspapers

[2018] 1 WLR 6060

at ¶764 and the judgment of Warby J (as he then was) in NT1 v Google

[2019] QB 344

at ¶98). See further the analysis pertaining to “artistic purposes” set out below at ¶52. :

b. The fact that the relevant processing is undertaken for profit-making purposes does not prevent the processing being “for the special purposes”.

c. Processing may be for the special purposes despite the novelty or non- traditional nature of the controller’s underlying business model and does not require the controller itself to be the person who is generating the relevant special purposes content See further: (i) NT1 where it was accepted that a third party which facilitates or supports the dissemination of journalistic content but did not itself create such content – e.g. a printing company printing newspapers (no doubt for profit) – could be processing personal data for the special purposes: §100. .

[91]In response the IC argued that the threshold question raised by section 156 is not whether Article 10 rights may be engaged by a penalty notice, or the potential implications of a penalty notice for Article 10 rights. Rather, the question is whether the MPN is given in respect of processing for the special purposes. The section 156 regime does not apply simply because an MPN may have consequences (however minor or significant) for others’ freedom of expression rights. That is not what the Parliamentary language provides for (nor would it be in line with the purpose of the regime, set out above, to provide derogations from the right to privacy “only if they are necessary”). Other fundamental rights, such as the right to freedom of expression, may sometimes be engaged when the provisions apply, but that does not mandate a broader reading of the derogation. In Satamedia at paragraph 56, the CJEU importantly emphasised that: “in order to achieve a balance between the two fundamental rights, the protection of the fundamental right to privacy requires that the derogations and limitations in relation to the protection of data provided for in the chapters of the directive referred to above must apply only in so far as is strictly necessary”.

[92]The IC argued that the Tribunal must keep in mind that s.156 DPA must be construed in light of the UK’s international obligations to have regard to the best interests of children when taking public actions. Article 3(1) of the UN Convention of the Rights of the Child provides that:

“in all actions concerning children, whether undertaken by public or private social welfare institutions, courts of law, administrative authorities or legislative bodies, the best interests of the child shall be a primary consideration”

. This is a “binding obligation in international law”: see ZH (Tanzania) v SSHD

[2011] UKSC 4

at paragraph 23 per Lady Hale.

[93]The IC amplified this further at paragraphs 77-81 of his skeleton argument, noting that TikTok argues that the MPN has the potential to interfere with the Article 10 rights of TikTok and its users (GoA paragraph 45(b)) by requiring more stringent age gating or moderation that may apply to all users. In particular, TikTok claims that improved age corroboration or verification procedures will apply to all users (GoA paragraph 41(a)) and that moderation aimed at increasing the removal of Underage Children affects all users (GoA paragraph 41(b)). It goes on to argue that the MPN will therefore have “obvious” and “very serious implications” on the right to freedom of expression of over 13s (GoAparagraph45(c)) because:(i) some people who are 13 or over may not wish to provide a document showing their age; and

(ii) increased stringency in the approach to moderation will increase the risk that users over 13 will have their accounts suspended.” He argues that this is wrong and does not reflect section 156 as properly interpreted, which focuses on the purposes or object of the processing with respect to which the MPN is given.

[94]He adds at paragraph 79:

“Requiring a teenager or adult who wishes to use TikTok to verify their age (and/or occasionally to re-verify their age) is not a serious interference with the fundamental right to freedom of expression protected by Article 10 ECHR and/or is in any event a justifiable and proportionate one in contexts such as this. Platforms have all kinds of affordances that may affect the experience of people using them. They will have security restrictions (such as two-factor authentication), they may require payment; they may occasionally over-moderate and remove content even if it does not breach any rule; they may crash or glitch. None of these are likely to amount to a breach of Article 10.”

He concludes at paragraph 81 “The question for the Tribunal is not whether some TikTok users’ Article 10 rights might be engaged by possible consequences of the MPN, or how far they might be engaged; but whether the relevant processing with respect to which the MPN was issued was processing “for the special purposes” as defined in the DPA."

[95]Mr Facenna noted that the language of section 156 is very precise, using “for” the special purposes, rather than “relating to” or “in connection with” them. It has not, for example used similar wording to that in Section 12 of the Human Rights Act 1998, which deals with what applies if a court is considering whether to grant relief which might affect the right of freedom of expression. The much more specific processing-focused language of section 156 is not consistent with any suggestion that section 156 should be engaged simply based on an Article 10 threshold. It is plainly not the case that section 156 kicks in simply because there is some engagement either with the data controller's free expression rights or the free expression right of third parties.

[96]In his closing submissions Mr Facenna said the characterisation of the TikTok service and the nature of its business as being effectively a business which was created to promote Article 10 rights, is not one which is reflected in any public document or commentary by TikTok, or indeed in TikTok's own evidence in this appeal.

[97]Mr Facenna summarised the IC’s position by saying that Section 156 itself balances not Article 10 rights generally, but the right to freedom of expression being exercised in specific circumstances involving the processing of personal data for specific purposes. It balances those activities against the right to privacy protected by the data protection legislation, and in the present case the data protection rights of young children whose data TikTok was processing unlawfully during the relevant period.

[98]Having determined at paragraph 54 above that Parliament had clearly decided in enacting DPA 2018 exactly how it wished to balance the competing rights in play, including Article 10, we do not consider that it is for the Tribunal to try and second-guess where this balance should lie. Accordingly, we were not persuaded that greater weight should be given to Article 10 by the Tribunal than was given to it by Parliament in seeking to reconcile it with the right to data protection. The question in the Preliminary Issue is much narrower than that – we are concerned with exactly what processing the MPN concerned and whether that processing was carried out for special purposes.

[99]Even if we are wrong on this, we do not consider that

Article 10 ECHR

alters our decision on the Preliminary Issue. The Processing Issue

[100]The first question for the Tribunal is what the processing was with respect to which the MPN was given.

[101]TikTok submits that the MPN concerns the processing of all UK users’ personal data that TikTok undertakes in order to provide the Service. It argues that the MPN on its face at paragraph 5(b) states “In providing its services, TikTok processed UK users’ personal data, amongst others, to support the provision and functionality of TikTok’s services, and to monetise such services, including by providing targeted advertising to is UK users and by offering in app purchases”.

[102]Having examined the MPN, we find that paragraph 5(b) sets out the background to TikTok, how it works and the basic regulatory context, - indeed it comes under the heading ‘Introduction’. The Commissioner refers to this as ‘scene setting’ which we find to be an accurate reflection of what is being addressed at this part of the MPN. The MPN has 271 paragraphs and is 99 pages long without annexes – or 193 pages with annexes. This was the very beginning of the MPN and is setting out a short summary/background to the case. We do not find that paragraph 5 is determinative of the what the MPN relates to. The IC’s view of the ‘failures’ or infringements and the reason for the MPN are not addressed in this section (other than very briefly at paragraph 5(d)).

[103]TikTok relies on paragraph 28 of the MPN in their Grounds of Appeal and again in their skeleton argument. They maintain that in this section of the MPN, the IC argues that harmful content that may be available on the services is relevant to the MPN “because (i) TikTok processes data about, inter alia, children’s use of its platform in order to deliver bespoke content” (emphasis added).

[104]We note that paragraph 28 MPN comes under the heading ‘FACTUAL BACKGROUND’ and the subheading ‘(5) Concerns regarding harmful content’. It starts with the words ‘Under the UK GDPR, children enjoy special protection with respect to the processing of their personal data. The Commissioner considers it is relevant briefly to set out the concerns that have been raised regarding content on TikTok which may be harmful and unsuitable for children under 13’. We find that this paragraph of the MPN was not addressing the specific processing for which the MPN was given, it was setting out background and concerns re harmful content for children under the age of 13.

[105]TikTok argues that the MPN purports to regulate its processing activities for all users, in particular the age-gating and moderation measures that it applies to all users of the Service. TikTok maintains that the thrust of the MPN is that TikTok ought to have applied more onerous age-gating and moderation measures across its user base, with a view to achieving the objective of keeping Underage Children off the platform altogether.

[106]TikTok submits at paragraph 61(iii) of its skeleton argument that: ‘It is simply impossible to divorce a notice of this nature from the processing which TikTok undertakes for the purposes of delivering the Service to its users, both adult and child. The MPN effectively attacks the ways TikTok processes user data both when admitting individuals as users to the Platform and when deciding whether user generated content that is on the Platform is content produced by an under-age user. Such processing activities form an integral part of delivering the Service to all users, and relatedly fundamentally affects the exercise of Article 10 rights of users (as well as TikTok’s Article 10 rights), because it affects who is permitted to place content (or continue placing content) on the Platform’.

[107]The IC takes a very different view. He submits that the MPN was given with respect to specific processing of data by TikTok. Paragraph 27 of his skeleton summarises it as follows:

“The MPN was given with respect to TikTok’s contraventions of Articles 8 (consent in respect of children) and 5(1)(a) (lawful and fair processing) in respect of Underage Children. The only contraventions the MPN encompassed relating to all TikTok users are transparency failures contrary to Articles 12 and 13 UK GDPR.”

[108]The IC goes on to say that the MPN is concerned in part with processing by TikTok that permits or enables Underage Children to open TikTok accounts and use TikTok, contrary to TikTok’s own terms of service...this aspect of the MPN was not given ”with respect to” what TikTok calls “Service Delivery Processing”(i.e. the provision of the TikTok service to TikTok users generally) but only in relation to the provision of TikTok to Underage Children. Secondly it relates to “Unlawful processing of the personal data of Underage Children (but not TikTok users in general) for the delivery of targeted advertising”. It is common ground that such TA processing is not for the special purposes.

[109]Thirdly, the IC notes that TikTok’s failures to comply with Articles 12 and 13 UK GDPR in respect of TikTok users in general did not involve the processing of personal data; the relevant provisions of the UK GDPR required TikTok to provide transparency information about its use of personal data. Even if this aspect of the MPN were arguably concerned with the processing of personal data, it was not processing by TikTok for the special purposes.

[110]We have reviewed the MPN in detail. Our view is that the MPN, read as a whole, was given in relation to the alleged unlawful processing by TikTok of the personal data of Underage Children. It is at the very heart of the reasoning in that notice. In reaching this conclusion we were particularly persuaded by the following paragraphs of the MPN: 37. “Article (1) of the UK GDPR, read together with section 9 DPA, imposes a requirement that information society services can be offered directly to a child under the age of 13 only where consent has been given or authorised by the holder of parental responsibility (at least where consent is relied upon as the basis for the processing under Article 6 UK GDPR). Absent such consent the processing of the personal data of a child younger than 13 is unlawful”. 59. “For the reasons set out above, the Commissioner has found that `TikTok’s processing of the personal data of children under 13 was in breach of Article 8, and therefore unlawful, at least in sofar as such processing was based on consent”. 62. “The Commissioner has found that during the Relevant Period TikTok failed to make any such reasonable efforts’ to prohibit children under the age of 13 from using the platform”. 90. “…contrary to TikTok’s submission that ‘as a matter of law Article 8 is entirely inapplicable, the Commissioner’s findings on Article 8 apply, a minimum, to the significant amount of processing of underage children’s personal data that TikTok carried out for the purposes of personalised advertising”.157. "For the reasons explained above, the Commissioner has found that TikTok failed to fairly and lawfully process the data of users during the Relevant Period, with particular reference to child users. In particular TikTok failed adequately to restrict access to its platform to users under 13 years of age, meaning that children who were too young to use TikTok without parental consent were able to do just that”.

158. “Insofar as TikTok relied on contractual necessity as a basis for its processing of the personal data of UK users under the Age of 13, it failed to have in place a lawful basis for such processing, which was therefore in breach of Article 5(1)(a)”. 177. “As regards the penalty for the contravention of Article 8 UK GDPR, children under the age of 13 are not permitted to use TikTok’s services or platform”. 201. “(i) The breach of Article 8 UK GDPR involved the processing of the data of young children without a lawful basis. The particular seriousness of breaches involving children’s data is apparent from the special protection given to children by the UK GDPR” 201(b). “As further addressed at paragraphs 228-233 below, the Commissioner has found that the breaches were negligent and had the potential to result in harm (in particular to young children): Tik Tok was negligent in that it ought to have been aware that it was processing the data of under 13s without consent given or authorised by the holder of parental responsibility over such child users. In addition, it ought to have been aware that it was inappropriate to rely on contractual necessity as a lawful basis for the processing the data of under 13s, in particular because there was no valid contract in place with under 13s, who, in line with TikTok’s Terms of Service were not permitted to be on the platform. Further, an organisation of TikTok’s size and sophistication ought to have been aware that its Privacy Policies were inadequate. The Article 8 UK GDPR breach resulted in harm to children under the age of 13. A user’s young age warrants particular parental oversight in respect of the quantity and nature of personal data they share on a platform such as TikTok. The breach of Article 8 deprived underage users of that important oversight. Furthermore, and as noted above in paragraphs 28-9, concerns have been raised regarding content on TikTok which may be harmful and unsuitable for children under 13. It is also important to note that some of the Relevant period covered the first lockdown, when children were particularly exposed to social media and VSPs such as TikTok and the numbers of very young children using the platform was increasing significantly, and hence TikTok ought to have been especially vigilant”. 208. “The failings identified by the Commissioner’s investigation, as detailed above, involved the processing of young children’s personal data”.

[111]TikTok submits that it is impossible to divorce the notice from the processing which TikTok undertakes for the purposes of delivering the Services to its ‘users’ and that the processing activities which are attacked in the MPN, are an integral part of ‘delivering the services to all users’. However, this fails to consider that according to TikTok’s terms of service, children under the age of 13 are not permitted on the platform. It cannot therefore be said that the processing activities which are attacked in the MPN are in relation to a service being delivered to all its ‘users’, as children under the age of 13 are not permitted to be ‘users’.

[112]For these reasons we consider that the processing with which the parts of the MPN dealing with the alleged breaches of Articles 5 and 8 was concerned was the processing of personal data for Underage Children. Whether or not there were in fact breaches is a matter for the substantive hearing on this case, not the Preliminary Issue.

Processing for the purposes of targeted advertising (TA)

[113]In relation to the issue of TA processing, a significant focus of the submissions in this case was whether the MPN was concerned with the processing involved in providing TA.

[114]Ms Proops argued that TA processing was scarcely mentioned in the MPN, being only “glancingly” referred to at paragraphs 87-90. She said that the MPN made no effort to identify the specific TA processing operations in issue, nor any harm flowing from it and no reference was made to this in the IC’s press release concerning the MPN. She argued that the emphasis on TA processing is an afterthought and an attempt to rescue what would otherwise be a manifestly untenable analysis under Article 8. It does not detract from the fact that the MPN read as a whole is with respect to processing in support of the delivery of the Service. Ms Proops drew attention to the evidence of Mr Stafford that TikTok did not conduct targeted advertising in the UK and advertisers were unable to target any advertisements to UK users until early 2019 when TikTok for Business was launched.

[115]The IC’s case was that that throughout the relevant period, TA processing lay at the heart of TikTok’s business.

[116]The relevant paragraphs of the MPN are paragraphs 87-90. We note that the heading for this section specifically refers to personalised advertising:

‘TikTok does rely on consent as a lawful basis for processing for the purposes of personalised advertising’

. It goes on to state: 87. TikTok acknowledges (as noted above, in a footnote to its Written Representations), that during the Relevant Period, it did rely on “consent when processing personal data for the purpose of personalised advertising”. It is thus wrong for the Written Representations to suggest that “as a matter of law Article 8 is entirely inapplicable”. 88. TikTok has not specified in its Written Representations, and the Commissioner has not been able to quantify, the exact amount of personal data that were processed by TikTok on the basis of consent. However, given the considerable proportion of TikTok’s revenues that is derived from personalised advertising, and the intrusive nature of processing required in that context, the Commissioner considers that a significant amount of TikTok users’ personal data has been processed by TikTok “for the purpose of personalised advertising”. In the circumstances, TikTok relies on consent for a significant part of the processing that it undertakes, including in relation to underage users. 89. The reasons given by TikTok for relegating this important issue to a mere footnote in its Written Representations is that processing for purposes such as personalised advertising is “not the focus of the NOI”. However, this is misguided. The NOI explicitly covered TikTok’s processing of UK users’ personal data “to support the provision and functionality of TikTok’s services, and to monetise such services, including by providing targeted advertising to its users and by offering in app purchases”. 90. Therefore, contrary to TikTok’s submission that “as a matter of law Article 8 is entirely in appliable” the Commissioner’s findings on Article 8 apply, at a minimum, to the significant amount of processing of underage children’s personal data that TikTok carried out for the purposes of personalised advertising, irrespective of the further arguments advanced by TikTok in respect of other bases for processing on which it purports to rely (addressed below).”

[117]Bearing in mind the parameters of the Preliminary Issue, we are satisfied that at least some of the processing with which the MPN is concerned is processing of personal data of Underage Children in connection with the provision of targeted advertising.

[118]We conclude that the MPN was explicitly concerned with the processing of TA, in particular noting the following sentences:

‘the Commissioner considers that a significant amount of TikTok users’ personal data has been processed by TikTok “for the purpose of personalised advertising”’ and ‘The NOI explicitly covered TikTok’s processing of UK users’ personal data ‘to support the provision and functionality of TikTok’s services, and to monetise such services, including by providing targeted advertising to its users’ and ‘the Commissioner’s findings on Article 8 apply, at a minimum, to the significant amount of processing of underage children’s personal data that TikTok carried out for the purposes of personalised advertising’

. We note that the NOI also referred specifically to TikTok’s processing of UK users’ personal data to provide targeted advertising to its users.

[119]We accept that the MPN did not deal with this issue at length. Again we accept that it made no effort to identify the specific TA Processing operations in issue, nor any harm flowing from it. We accept that no reference was made to this in the press release concerning the MPN which the ICO published. We make no finding as to whether the emphasis on TA processing was an afterthought, nor the extent to which TA was actually in play during the relevant period. The Tribunal will consider further the question of the extent to which such processing actually occurred during the Relevant Period and whether such processing breached UK GDPR at the substantive hearing of this case. For the purposes of the Preliminary Issue, we are just required to consider whether the MPN was concerned with the processing involved in providing TA. We conclude that it was. Transparency findings – is this processing?

[120]The third point raised by the IC was in relation to the transparency findings in the MPN in relation to alleged breaches of Articles 12 and 13 UK GDPR. The question for the Tribunal in the context of the Preliminary Issue is whether such alleged failings are in fact processing in respect of which the MPN was issued.

[121]It is common ground that part of the MPN was given in respect to TikTok’s alleged failure to provide information to users about its processing activities, especially its published privacy policies, as required by Articles 12(1) and 13 UK GDPR.

[122]The IC submits that this aspect of the MPN cannot fall within section 156 DPA because section 156 only applies where a MPN is given with respect to “the processing of personal data”. These sections (i.e. the sections concerned with Articles 12(1) and 13 UK GDPR) do not concern the processing of personal data by TikTok.

[123]Mr Facenna submitted that there is a distinction in the UK GDPR between provisions imposing duties to process data in specified ways, and other duties that do not require the controller to process data in specified ways. Article 5(1)(a) falls within the former category, as does Article 8(1)(a). However, in contrast, Articles 12(1) and 13 do not impose a duty to process data in any specified way. Instead, they are concerned with the provision of information by a data controller about the processing of personal data. Compliance with Articles 12(1) and 13 does not entail the processing of any personal data and therefore does not fall within section 156 DPA 2018.

[124]TikTok argued at paragraph 39 of its Reply that Article 13 applies “where personal data relating to a data subject are collected from the data subject, and thus only in connection with the processing of personal data. It is not a duty that exists in the ether”. Ms Proops argued that these transparency obligations cannot be detached from any particular underlying processing operation. Paragraph 61(3) of TikTok’s skeleton argument summarised the point as follows “As with all other duties provided for under the Act, any transparency duty to which a controller is subject is necessarily anchored in the processing operations which that duty relates. The duty is in effect a duty to be transparent specifically in respect of that processing operation. It follows that the transparency findings contained in the MPN – which substantially concern the way in which TikTok has described the processing undertaken in the context of the delivery of the Service to users - are with “respect to” the processing entailed on the delivery of the Service.

[125]TikTok argued that Article 13 is the lex specialis to the Article 5(1)(a) duty to process data transparently.

(a) states:

“Personal data shall be: Processed lawfully, fairly and in a transparent manner in relation to the data subject (‘lawfulness, fairness and transparency’)”

. Ms Proops submitted that "Articles 12 and 13 plainly comprise sub-rules of a general rule on transparency, which the ICO accepts does concern underlying processing. It simply makes no sense to say that the general rule on transparency relates to processing, but the rules made under that general rule i.e. the lex specialis do not”.

[126]The IC accepted in oral submissions that contraventions under Article 13 will often mean that there is necessarily a contravention of the overarching transparency duty under Article 5(1)(a). However, he submitted that when the MPN is read as a whole, the parts of the notice given with respect to transparency contraventions are about the content of TikTok’s privacy notice – not about how they processed any personal data. Therefore, enforcement action concerning a failure to comply with Articles 12 and 13 is not within the scope of section 156. Having gone through the MPN in detail, we agree that the transparency contraventions in the MPN relate to the privacy notices, not to how TikTok processed data. We note TikTok’s oral submission that the privacy notices themselves are substantially concerned with TikTok’s delivery of the services to its users. Although this is correct, the issue being taken in the MPN when considering this subject is the alleged failure to provide information in the privacy notices, it is not related to breaches of processing of personal data. We further expand upon this below.

[127]We were reminded by the IC that it was not for the Tribunal to determine whether Articles 12 and 13 can be said to relate to any processing. S.156 simply requires us to consider whether the MPN in this case was given with respect to the processing of personal data for special purposes. Having considered the MPN in some detail, we have concluded that the sections dealing with Articles 12 and 13 were not given with respect to breaches of processing of personal data (addressed in further detail below) – they were given with respect to breaches of procedural obligations.

[128]We make no finding as to whether Article 13 is lex specialis to Article 5, as we have concluded that even if it is, Articles 12(1) and 13 impose duties to provide information; they do not impose duties to process personal data in any particular way and do not therefore engage section 156. This can be seen from the wording of the statute, highlighted below in bold:

“12(1) The controller shall take appropriate measures to provide any information referred to in Articles 13 and 14 any communication under Articles 15 to 22 and 34 relating to processing to the data subject in a concise, transparent, intelligible and easily accessible form, using clear and plain language, in particular for any information addressed specifically to a child. The information shall be provided in writing, or by other means, including, where appropriate, by electronic means. When requested by the data subject, the information may be provided orally, provided that the identity of the data subject is proven by other means… (13(1) Where personal data relating to a data subject are collected from the data subject, the controller shall, at the time when personal data are obtained, provide the data subject with all of the following information…”

[129]The MPN takes issue with TikTok’s alleged failure to provide the information – it is not related to the personal data (see paragraphs 5(d)(iii) and (iv), 112-114, 119-134, 136-154, 217, 223-4, 227 and Annexe 3).

[130]We accept the IC’s submission that this reflects that, in practice, compliance with the duties under Articles 12 and 13 does not impact on the processing of personal data for special purposes.

[131]We accept TikTok’s submission that Articles 12 and 13 arise in connection with the processing of personal data; it does not exist in the ‘ether‘, any other conclusion would make no sense. However, we agree with the IC’s core submission that this does not mean that that Articles 12(1) and 13 regulate the processing of personal data. We do not accept that coming to this conclusion, means that we are finding that the transparency obligations operate in some kind of vacuum detached from the underlying processing operation We accept that the obligations arise in the context of a data controller engaging in processing operations but that is not the test in section 156, which operates “with respect to the processing of personal data”, not the context of that processing. Rather we agreed with the IC’s submission that “Processing of personal data within the meaning of the UK GDPR is the backdrop to those duties, but the processing itself is not regulated by the duties imposed by those provisions. The same is true of eg the duty to keep records (Article 30) and the duty to appoint a data protection officer (Article 37)” (paragraph 34 Skeleton Argument). We preferred this because we considered this was more congruent with the wording of section 156.

[132]Having considered the MPN in some detail, we have concluded that the sections dealing with Articles 12 and 13 were not given with respect to breaches of processing of personal data but given with respect to breaches of procedural obligations. For the purposes of the Preliminary Issue, therefore, the alleged breaches in relation to transparency obligations under UK GDPR Articles 12 and 13 was not the processing of personal data with which the MPN was concerned.

The Special Purposes Issue

[133]The next question for the Tribunal is whether the processing with respect to which the MPN was issued was for the special purposes.

[134]As discussed above, we accept that following Satamedia a broad approach needs to be adopted to the question of what is meant by the special purposes, one of which is artistic purposes.

[135]It is common ground between the parties that not all the content on TikTok is artistic and there is no case decided under EU or UK data protection legislation which addresses the question of what “artistic purposes” means.

[136]TikTok accepted in its written submissions that not all forms of creative endeavour will qualify as artistic in nature for the purposes of section 174(1). A threshold must be crossed for an activity to be characterised as “artistic”. The real question in this case is how that threshold falls to be identified/characterised. It contended that the following principles should be applied, drawn from copyright law 1. see for example Hensher v Restawile Upholstery

[1976] AC 64

, at pp.78 (per Lord Reid), 81-82 (per Lord Morris), 94-95 (per Lord Simon) and 97 (per Lord Kilbrandon) and Lucasfilm Ltd v Ainsworth [2008] ECDR 17 per Mann J at 118, approved by the Supreme Court (

[2011] UKSC 39

) at ¶¶36-37. : “(1) First, the FTT should not make aesthetic judgments in order to determine whether a particular work is artistic or not. Instead, other objective factors must be identified (considered further below). (2) Secondly, the term “artistic” is not limited to works of fine or high art. It is instead a more flexible term that is apt to cover a much wider range of creative endeavours. (3) Thirdly, there is no single necessary and sufficient condition that can be applied so as to determine whether a work is artistic. Instead, a multi- factorial approach is necessary. Matters such as the purpose for which a work is created (the intent of the creator); the purpose for which it is received/consumed (the intent of the consumer); the nature and level of skill and judgment that has been applied to create the work (the creative skill) and the degree of visual appeal are relevant factors. The weight of those factors, and the extent to which others may also have a bearing, will vary from context to context. (4) Fourthly, the fact that a work is created for a commercial purpose does not preclude it being “artistic”. (5) Fifthly, expert evidence on the question whether a particular work is or is not artistic may be necessary. The opinion of a properly qualified expert can carry significant weight.

[137]It argued that these should apply because they reflect a common-sense approach, they properly recognise the limits of the court’s competence, they reflect the principles approved in Satamedia that a wide and flexible approach must be applied in respect of the special purposes concepts, and they are consonant with an Article 10-compliant reading of the special purposes provisions comprised within the UK GDPR.

[138]TikTok argued thatthe opinion of Professor Abell should carry considerable weight with the FTT on the questions of(i) the extent to which the design of the Service meant that users were positively encouraged to and also assisted in creating artistic works and

(ii) the extent to which the Service was in fact used by users during the Relevant Period to create and consume artistic content.By contrast, the IC argued that the Abell Report does not go to any point in dispute in these proceedings. It says “nothing about how, or for what purpose, the personal data with which the MPN is concerned are actually processed by TikTok”. It also notes that Professor Abell estimates that fewer than half of the ‘Top 100’ TikTok videos assessed for the purposes of the Abell Report “constitute art or represent art”. It therefore invited the Tribunal to place limited weight on Professor Abell’s evidence in the context of the Preliminary Issue.

[139]We were persuaded by Mr Facenna that the question before the Tribunal on this Preliminary Issue is not whether or not the content posted on TikTok is artistic in nature. The fact that 48 of the 100 videos analysed by Professor Abell were in her view artistic does not, in our view, provide an answer to the question of whether the specific processing to which the MPN refers was for the special purposes. Whilst the fact that content is artistic may indicate the possibility that there may be some sort of processing for an artistic purpose going on, the Tribunal’s task is to determine whether the specific processing which is the subject of the MPN was for the special purposes. The presence of some artistic content is not enough by itself to replace the need to carry out this task. For this reason, we rejected TikTok’s submission that “the fact that the Platform is hosting so much artistic content is not, to use the language of NT1, “purely accidental”. Rather, it is the upshot of the way the Service is designed, and entirely consistent with TikTok’s mission.” We do not consider this is sufficient by itself to demonstrate that TikTok’s data processing was for artistic purposes.

[140]More broadly in relation to the Special Purposes issue, TikTok argued that its service is a free expression service; it is an online intermediary service that enables tens of millions of people to exercise their free expression rights online. Whereas many other ISP services operate deliberately on a content-neutral basis (for example Google), the Service is very firmly and deliberately oriented towards the creative and artistic: it seeks to encourage users to create, share and consume content which is inherently creative and indeed artistic, both through its promotional materials which explain how TikTok intends the Service to be used and through the specific tools it makes available to users on the Platform.

[141]These tools were described in detail by both Mr Stafford and Professor Abell. TikTok argued that these tools serve to both encourage and support users in generating artistic content, artistic content which can in turn be shared with other users on the Platform, who may in turn creatively interact with such content (e.g. by using them to create artistic “memes”). While users can generate videos which are artistic in nature without the use of the tools, the availability of the tools substantially enhances the orientation and ability of users to use the Platform to express themselves and participate in the creation, sharing and consuming of artistic user generated artistic content on the Platform. TikTok therefore argued at paragraph 66 of its skeleton argument “Put shortly, the Service is very substantially oriented to the artistic both in terms of its design and in terms of the content it actually processed during the Relevant Period" which it says means its processing in delivering the Service to users is “for the special purposes”. At paragraph 71 TikTok also notes “the Service was also used to disseminate significant quantities of journalistic, academic and literary content”. It says this reinforces the fact that section 156 should apply in this case.

[142]Ms Proops argued that the TikTok service was during the Relevant Period a fundamentally different service to the Google search engine service which was the subject of the NT1 case

[2018] EWHC 79

(QB) . It fundamentally differed even from other video-sharing platforms such as the YouTube platform.

[143]In her oral submissions, Ms Proops argued that the processing TikTok undertook in delivering the service to its users during the Relevant Period was for the special purposes having regard both to the essential design of the service, its fundamental orientation to enabling and encouraging artistic expression, and the fact that this service design resulted in the service being used by users in a way that was heavily skewed in favour of artistic expression, whilst accepting not all content was artistic. In the circumstances she said the Tribunal should conclude that the processing TikTok undertook to deliver the service to its users was for the special purposes, specifically for the purposes of art.

[144]Professor Abell concluded that having reviewed the Top 100 videos during the Relevant Period, 48 either constitute art or represent art when applying her criteria, with a further three possibly doing so, but in relation to which she was not able to reach a firm conclusion. Ms Proops argued that this is a fair barometer of how users were using the service during the Relevant Period and that this strongly supports TikTok’s case that not only was the service designed to enable and encourage artistic expression but that that service design in turn caused the service to be used by users in a way that was heavily skewed towards artistic expression. This meant, she says, TikTok’s processing entailed on delivering the platform services to its users was for the special purposes.

[145]Ms Proops said that TikTok accepts that to meet the “for the special purposes” test, something more than some kind of vague connection with the special purposes is needed. TikTok's case is that its service design processing is caught because fundamentally it is processing that is designed to enable and encourage artistic expression. She went on to argue later that it is the non-artistic use of the service which is incidental to TikTok’s larger purpose of enabling and encouraging artistic expression.

[146]The IC set out his case on this issue at Section E of his skeleton argument. Firstly, he argued thatprocessing for the purposes of delivering targeted advertising to Underage Children (which is the processing relevant to the infringement of Article 8) was not processing for the purposes of journalism, or for academic, artistic or literary purposes. At paragraph 69-70 he noted “Processing for special purposes does not need to be non-commercial (e.g. processing for commercial journalism or literary publishing), however processing of users’ personal data by TikTok to monetise its user base and deliver targeted advertising is processing carried out for a commercial purpose only: that processing has no journalistic or artistic purpose. The processing, and the commercial imperatives and purposes which motivate such processing, are described in detail in section 5 of the Krämer Report...The parts of the MPN concerned with such processing therefore fall outside the scope of s.156.”

[147]Secondly, any processing by TikTok for the purposes of seeking to prevent Underage Children from accessing its services, or for detecting and removing Underage Children (which is the processing that was considered by the IC in relation to Article 8(2)) was also not processing for the special purposes. It was for the purpose of preventing Underage Children from accessing and using the platform.

[148]Thirdly, any other unlawful processing by TikTok of the data of Underage Children (i.e. processing in breach of Article 5(1)(a) owing to a lack of lawful basis) was also not processing for the special purposes. That could only (even arguably) be the case if TikTok demonstrated that such processing was undertaken for the purposes of journalism or for the academic, artistic or literary purposes of TikTok or Underage Children themselves.If use of the platform by Underage Children is contrary to TikTok’s terms and conditions, by definition TikTok’s purpose in processing the data of those Underage Children is not to facilitate their use of its platform for any purposes at all, including any special purposes. Indeed, if TikTok had appreciated that any given Underage Child was using its platform contrary to its terms and conditions, TikTok would have actively prevented them from doing so, and would not have intended any further use of their data.

[149]Fourthly, the transparency failures represented in the MPN by the breaches of Articles 12 and 13 UK GDPR are not about processing of personal data at all so section 156 is not engaged.

[150]He concluded that none of TikTok’s unlawful processing of Underage Children’s personal data (i.e. the processing in respect of which the MPN was given) was processing for the special purposes. Section 156(1) therefore did not apply.

[151]Mr Facenna elaborated in his oral submissions for the IC that service data processing is not special purposes processing because TikTok has no journalistic or artistic purpose in processing that personal data of its users. In doing so it is completely blind to whether the user might be generating or consuming artistic or non-artistic content, and it is doing that processing for the purposes of providing the service including to display advertising. He gave an example of the difference between when a newspaper publishes names of individuals on its website which would be special purposes processing and processing subscribers’ personal data to charge them for their subscription, which would not. He observed that “The most fundamental problem for TikTok's case is Professor Krämer's evidence that there is no hermetic separation between the service when delivering advertisements and when it is delivering other content. “

[152]Mr Facenna concluded "for" has to be interpreted in a way that respects both of the fundamental rights in issue and it has to be applied subject to the strict necessity test. It is not just a factual question of identifying something that might be described as special purposes processing. In his oral submissions he argued that applying the word "for" and the rest of the wording of section 156 in a way that is broad and indiscriminate is incompatible with the approach of strict necessity and treating the derogation narrowly. He also argued that it would be incompatible with the Tribunal's own duties under section 6 of the Human Rights Act to make sure that that there is derogation from Article 8 rights, in this case of children, only insofar as strictly necessary. He emphasised that the interest of the child is a primary consideration because of ZH (Tanzania).

[153]In light of our finding above that the processing with which the MPN concerned was the processing by TikTok of the personal data of Underage Children contrary to Articles 8 and 5(1)(a) UK GDPR, we only need to consider the special purposes issue respect of this specific data processing. In doing so, as we are required to do, we paid due regard to the best interests of the children concerned.

[154]We were persuaded by Mr Facenna’s argument that by definition TikTok’s purpose in processing the data of those Underage Children cannot be to facilitate their use of its platform for any purposes at all, including any special purposes. Indeed, if TikTok had appreciated that any given Underage Child was using its platform contrary to its terms and conditions, TikTok would have actively prevented them from doing so, and would not have intended any further use or processing of their data. Whilst we noted TikTok’s arguments about the purposes of its Service being to facilitate creativity, its purpose and intention was never to do so for Underage Children at any time.

[155]It follows therefore that TikTok’s processing in relation to Underage Children, which was the processing with respect to which the MPN was issued, was not for the special purposes.

[156]Even if we are wrong on this, we consider that the processing in relation to targeted advertising was not for the special purposes. It is possible to process the same personal data collected in respect of an individual for a number of purposes. We accept that processing personal data such as a name for the purposes of publishing content created by that individual might conceivably be processing for the special purposes. However, this is not enough to satisfy us that if the same personal data was also processed for a different purpose unrelated to the creation of for example artistic or journalistic content, such as targeted advertising, that this processing would also be for the special purposes. It would be incidental at best and more likely than not it would be unrelated to the special purposes.

[157]We therefore conclude that the processing of personal data by TikTok in respect of which the MPN was made was not for the special purposes. Accordingly, the IC was not required to obtain leave from a court under section 156 before issuing the MPN and the MPN was not issued ultra vires. This is because the MPN concerns – and was given “with respect to” (the language of section 156 DPA) – specific processing of data by TikTok that was not “for the special purposes”.

The Consequences Issue

[158]Because we have determined that the MPN in its entirety was not issued ultra vires, for the purposes of this Preliminary Issue the entire MPN now falls to be determined by way of a substantive hearing, subject to any appeal. This means we do not need to consider whether or not those parts of the MPN which were ultra vires can be severed from the remaining issues, as the MPN remains intact as issued.

[159]Because the processing in respect of which the MPN was issued was not for the special purposes, we find that the IC was not required to follow the procedure set out in Section 156(1) before issuing the MPN.

[160]In its skeleton argument TikTok said that “It is not open to the ICO to use this appellate process to effectively investigate and put a case on factual matters which are at best of tangential relevance to the notice in issue, all the more so taking into account that none of these matters were remotely addressed in the Notice of Intent which the ICO was required to serve on TikTok (under Schedule 16 to the DPA 2018) and which the ICO was bound to ensure contained the nub of the regulatory case which TikTok was being asked to answer.“

[161]In her oral submissions, Ms Proops added that if the Tribunal permitted the targeting advertising processing findings to go forward this would circumvent the protections set out in Section 16 of the DPA 2018 in relation to the notice of intent. We understood the concerns on this point to be, in essence, with the consequences if the Tribunal permitted the case to proceed on a basis which had not been set out fully in the NOI. The implication appeared to be, although was not phrased by Ms Proops in these terms, that that would be unfair to TikTok to do so.

[162]It is frequently the case that an enforcement case brought by a regulator will evolve during the various stages of the case from how it was initially raised with the subject, often reflecting representations made by the subject. Any procedural unfairness (such as that flowing from

Article 6 ECHR

) which arises when the formulation of the regulator’s case changes from how it was pleaded at an earlier stage of the process (here the NOI) can be corrected by the statutory right to challenge the later iteration of the case (the MPN) by way of appeal and make representations in that context.

[163]In the case of Financial Conduct Authority v BlueCrest Capital Management (UK) LLP

[2024] EWCA Civ 1125

, the FCA at the outset of the Upper Tribunal reference filed a statement of case based solely on how the case had been framed at the earlier internal decision-making stage We note that “reference” is the term used in the Financial Services and Markets Act 2000 to denote an appeal to the Upper Tribunal and that it is analogous to an appeal in the current context . It then later applied to amend its statement of case to rely on a different formulation of the misconduct which had not been previously raised in the statutory notices issued at the internal decision stage. BlueCrest objected to the proposed amendments and applied to strike out parts of the FCA's statement of case. The Upper Tribunal (Tax and Chancery Chamber) refused the amendments on the basis that it did not have jurisdiction to consider these amendments, which had not been advanced in the FCA's statutory notices. They were based on different regulatory provisions to those referred to at the earlier internal decision-making stage in the notices; they did not embrace the allegations set out in the notices; they relied on facts and matters not pleaded in relation to the case set out in the notices; and they could have been included in the notices. This decision of the Upper Tribunal was overturned by the Court of Appeal and is currently under consideration by the Supreme Court.

[164]Popplewell LJ said at paragraph 202 of the CA judgment: “What is clear is that there must be some sufficient relationship between the matter referred and the decision which triggers the right to refer, and the critical question is: what is required by the concept of sufficiency in this context? The answer is to be found in the fact that the decision is a stage in the regulatory process, and the Tribunal reference a further stage in that process. The logical answer is therefore that something is sufficiently related to the decision which triggers the reference to amount to or be included in "the matter" if it has a real and significant connection with the subject matter of the process, in the sense of its procedural or substantive content, which has culminated in the decision notice or supervisory notice. Such connection must be real and significant, not fanciful or tenuous. But if so, that is sufficient. It need not be something upon which the FCA has specifically relied during the process, provided that it has a real and significant connection with the subject matter of the process. What is required when the FCA seeks to rely on something new in the Tribunal is an examination of what is new, and of the procedural or substantive content of the process culminating in the decision or supervisory notice, and the establishment of a real and significant connection between them. If what is new has this connection it is within the Tribunal's jurisdiction. It is a separate question whether the FCA should be permitted to rely upon it in any particular case, which is a matter for the exercise of the Tribunal's case management powers as to whether it would be just and fair”.

[165]Applying that here, although recognising we are here concerned with a different regulator and regulatory scheme, we are satisfied that the issue of the IC relying on targeted advertising in the MPN having not previously been included it in the NOI is analogous to the FCA’s amendments in BlueCrest. That is because the targeted advertising in our view has a real and significant connection with the subject matter of the MPN and therefore of the appeal. This is because, as we concluded at paragraph 115 above, we are satisfied that at least some of the processing with which the MPN is concerned is processing of personal data of Underage Children in connection with the provision of targeted advertising.We note in this connection that TikTok's written representations response to the NOI made reference, however indirectly in a footnote, to the targeted advertising issue. The statutory appeals process gives an opportunity for TikTok to challenge the MPN as it stands, irrespective of what was in the earlier notice. We therefore do not accept that it would be unfair to allow the IC to rely on an MPN which has evolved out of a differently framed NOI, because the current appeal process allows TikTok to make any representations it wishes relating to the MPN, so there is no procedural unfairness.

[166]For these reasons, we do not accept TikTok’s argument that the IC should not be allowed to rely on the allegations around targeted advertising set out in the MPN.

Conclusion

[167]For all these reasons we determine the Preliminary Issue in favour of the IC. We find that the MPN issued by the IC under section 155 and Schedule 16 of the DPA 2018 on 4 April 2023 was not made “with respect to processing of personal data for the special purposes” within the meaning of sections.156 and 174 DPA. Judge Harris Judge Kiai Judge Harris Judge Kiai Date: 27 June 2025

Cited in 1 later judgment

(1) TikTok Inc (2) TikTok Information Technologies UK Limited v The Information Commissioner: [2026] UKUT 277 (AAC) 2026