(1) TikTok Inc (2) TikTok Information Technologies UK Limited v The Information Commissioner: [2026] UKUT 277 (AAC) [2026] UKUT 277 (AAC)

UPPER TRIBUNAL

ADMINISTRATIVE APPEALS CHAMBER

[2026] UKUT 277 (AAC)

Case No UA-2025-001401-GIA

Between

(1) TikTok Inc (2) TikTok Information Technologies UK LimitedAppellant

The Information CommissionerRespondent

Before

Upper Tribunal Judge Wikeley

Upper Tribunal Judge Church

Date 28 July 2026

Category: Human rights law, Information rights

Subcategory: Human rights law article 10 freedom of expression, Information rights data protection

[1]Between 25 May 2018 and 28 July 2020 (the "relevant period" in relation to this appeal), TikTok Inc and TikTok Information Technologies UK Ltd (together "TikTok") operated an online video-sharing platform. The platform incorporated tools allowing users to create, edit, upload and/or view short-form video content which other users could view and 'react' to (the "service"). TikTok collected data from its users and, by applying algorithms to the data it collected, directed tailored content to users based on their previous interactions with the service. This tailored content comprised both "organic" content uploaded to the service by users, and targeted advertising content from which TikTok derived revenue.

[2]During the relevant period TikTok required users to warrant their date of birth. TikTok only permitted users whose warranted date of birth indicated that they had reached their thirteenth birthday to access the service ("age gating"). It is common ground between the parties that there were children who had not yet reached their thirteenth birthday ("underage children") who had circumvented TikTok's age gating by entering a false date of birth and used the service despite being underage.

[3]On 23 September 2022, the Information Commissioner (the "Commissioner”) gave TikTok a Notice of Intent with respect to its processing of personal data in connection with the service (the "NOI").

[4]On 4 April 2023, having considered submissions provided by TikTok in response to the NOI, the Commissioner issued TikTok with a Monetary Penalty Notice (the “MPN”) in the amount of £12,700,000 with respect to breaches of Articles 5(1)(a), 8, 12 and 13 of the UK General Data Protection Regulation ("UK GDPR") that the Commissioner found to have occurred during the relevant period.

The proceedings before the First-tier Tribunal

[5]TikTok appealed the MPN to the First-tier Tribunal on several grounds. These included an argument that the MPN was ultra vires because it was given “with respect to the processing of personal data for the special purposes” (in this case for artistic purposes) within the meaning of sections 156 and 174 of the Data Protection Act 2018 (“DPA 2018”), without the preconditions set out in section 156(1) DPA 2018 (i.e. the issuing of a determination under section 174(3) DPA 2018 and the obtaining of leave from a court) having been satisfied (the “vires challenge”).

[6]On 12 December 2023 Judge Griffin of the First-tier Tribunal directed that the vires challenge be heard as a preliminary issue.

[7]The preliminary issue was formulated by

Judge Griffin as follows:

“Was the MPN issued by the Commissioner under s.155 and Schedule 16 of the DPA 2018 on 4 April 2023 made “with respect to processing of personal data for the special purposes” within the meaning of ss.156 and 174 DPA?”

[8]On 19-21 May 2025 a panel of the First-tier Tribunal comprising Judges Harris and Kiai (the “FtT”) convened to hear the preliminary issue. The FtT dismissed the vires challenge and found, in a decision dated 27 June 2025 (amended under the slip rule on 25 July 2025) (the “FtT Decision”), that:a. the processing that the MPN was given “with respect to” was the processing of the personal data of underage children only;

b. the breaches of Articles 12 and 13 of UK GDPR found by the Commissioner related to procedural failings, and not to any processing of personal data;

c. since Parliament had, in enacting section 156 DPA 2018, balanced data protection rights with the right to freedom of expression under

Article 10 of the Convention

for the Protection of Human Rights and Fundamental Freedoms (the “Convention”), section 156 DPA 2018 was to be construed narrowly and without reference to

Article 10 of the Convention

;

d. the MPN was not made “with respect to processing of data for the special purposes” within the meaning of sections 156 and 174 DPA 2018; and

e. even if the MPN was given partly with respect to the processing of personal data “for the special purposes”, the remainder of the MPN was given with respect to the processing of personal data for the purposes of facilitating the delivery of targeted advertising to users (which processing TikTok accepted was not carried out “for the special purposes”), and the MPN should survive to the extent that it was given in respect of such non-special purposes processing.

[9]Permission to appeal the FtT Decision was granted by Judge Wikeley on 25 September 2025, in a decision that also suspended the effect of the FtT Decision pending determination of the appeal.

[10]On 30 September 2025 a direction was made under Article 3(2) of the First-tier Tribunal and Upper Tribunal (Composition of Tribunal) Order 2008 (SI 2008/2833) for a three-judge panel to hear the appeal on the basis that it raised “a question of law of special difficulty or an important point of principle or practice”.

[11]A three-judge panel of the Upper Tribunal heard the appeal on 11-12 May 2026. The Upper Tribunal is grateful to counsel and those instructing them for their careful preparation and clear presentation of the issues in their written and oral submissions.

Case management observations

[12]The FtT has the power to make an order that a preliminary issue will be determined in advance of other matters arising, and its order to that effect in this case is not under appeal. Nevertheless, the Upper Tribunal observes that this order has had the unfortunate effect that a challenge to a MPN issued on 4 April 2023 has only now in 2026 reached the stage of an appeal to the Upper Tribunal, and even then only in relation to a preliminary issue.

[13]It is clear that at least some of the evidence heard at the three-day hearing of the preliminary issue was considered by the FtT to be more relevant to the substantive grounds of appeal advanced by TikTok than to the vires challenge, so the hearing of the preliminary issue has not resulted in a clear separation of issues. The overriding objective of dealing with cases fairly and justly, which includes avoiding delay (so far as compatible with proper consideration of the issues), suggests that the First-tier Tribunal should exercise caution before separating cases into preliminary and substantive issues.

The grounds of appeal in summary

[14]TikTok’s Grounds 1 and 3 concern the FtT's construction of the MPN. The issue for the Upper Tribunal to decide in relation to Ground 1 is whether the FtT erred in law by construing those parts of the MPN that concerned breaches of Articles 5(1)(a) and 8 of the UK GDPR as being given only with respect to the processing of the data of underage children.

[15]The issue for the Upper Tribunal to decide in relation to Ground 3 is whether the FtT erred in law in holding that the parts of the MPN penalising TikTok for breaches of Articles 12 and 13 were not given with respect to the processing of personal data at all, but rather in relation to procedural obligations.

[16]Grounds 2 and 4 concern the issue whether the FtT erred in law in its finding that TikTok's processing of the personal data of underage children was not "for the special purposes". Ground 2 attacks the FtT's reasons, while Ground 4 argues that the FtT erred in law by failing to read and give effect to section 156 DPA 2018 compatibly with the Convention rights of TikTok and its users, as section 3 of the Human Rights Act 1998 (“HRA 1998”) requires.

[17]Ground 5 argues that the FtT erred in law in its obiter finding that the MPN could survive in part even if some of the processing in respect of which it was given was "for the special purposes". This ground is not material unless TikTok succeeds on one or more of the other grounds.

[18]The Upper Tribunal will first decide the central issue of the proper interpretation of the words “for the special purposes” in section 156 DPA 2018 (i.e. the issues arising from Grounds 2 and 4) and whether TikTok’s processing of its users’ data during the relevant period enjoyed the protection of the special purposes regime. It will then consider the remaining issues in the context of the proper construction of the MPN.

The statutory scheme

[19]UK GDPR, which constitutes the post-Brexit incarnation of the original GDPR (EU Regulation 2016/679), together with DPA 2018 (which replaced the Data Protection Act 1998 (the "DPA 1998")), creates a framework of rights and responsibilities in respect of the processing by controllers and processors of personal data that seeks to ensure that processing of individuals’ personal data is lawful, secure and transparent.

[20]Article 5 of the UK GDPR contains principles relating to the processing of personal data. At the material time, and so before its amendment by the Data Use and Access Act 2025 (“DUAA”), it provided as follows:

“Article 5 Principles relating to processing of personal data 1 Personal data shall be: (a) processed lawfully, fairly and in a transparent manner in relation to the data subject (‘lawfulness, fairness and transparency’); (b) collected for specified, explicit and legitimate purposes and not further processed in a manner that is incompatible with those purposes; further processing for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes shall, in accordance with Article 89(1), not be considered to be incompatible with the initial purposes (‘purpose limitation’); (c) adequate, relevant and limited to what is necessary in relation to the purposes for which they are processed (‘data minimisation’); (d) accurate and, where necessary, kept up to date; every reasonable step must be taken to ensure that personal data that are inaccurate, having regard to the purposes for which they are processed, are erased or rectified without delay (‘accuracy’); (e) kept in a form which permits identification of data subjects for no longer than is necessary for the purposes for which the personal data are processed; personal data may be stored for longer periods insofar as the personal data will be processed solely for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes in accordance with Article 89(1) subject to implementation of the appropriate technical and organisational measures required by this Regulation in order to safeguard the rights and freedoms of the data subject (‘storage limitation’); (f) processed in a manner that ensures appropriate security of the personal data, including protection against unauthorised or unlawful processing and against accidental loss, destruction or damage, using appropriate technical or organisational measures (‘integrity and confidentiality’). 2.The controller shall be responsible for, and be able to demonstrate compliance with, paragraph 1 (‘accountability’).”

Principles relating to processing of personal data

[21]Section 155 DPA 2018 empowers the Commissioner to issue penalty notices, as part of the enforcement regime.

[22]Section 156 DPA 2018 provides for restrictions on the Commissioner's power to issue a penalty notice with respect to processing "for the special purposes". These restrictions seek to reconcile the individual's right to the protection of their personal data rights with the fundamental right to freedom of expression and information protected by

Article 10 of the Convention

. The restrictions introduce an extra procedural step, requiring leave of the court before a penalty notice may be issued in cases about processing for the special purposes. Section 156 DPA 2018 provides, insofar as relevant:

“156 Penalty notices: restrictions (1) The Commissioner may not give a controller or processor a penalty notice in reliance on section 149(2) with respect to the processing of personal data for the special purposes unless— (a) a determination under section 174 with respect to the data or the processing has taken effect, and (b) a court has granted leave for the notice to be given. (2) A court must not grant leave for the purposes of subsection (1)(b) unless it is satisfied that— (a) the Commissioner has reason to suspect a failure described in section 149(2) which is of substantial public importance, and (b) the controller or processor has been given notice of the application for leave in accordance with rules of court or the case is urgent.” (a) a determination under section 174 with respect to the data or the processing has taken effect, and (b) a court has granted leave for the notice to be given. (a) the Commissioner has reason to suspect a failure described in section 149(2) which is of substantial public importance, and (b) the controller or processor has been given notice of the application for leave in accordance with rules of court or the case is urgent.”

[23]The special purposes are defined in section 174 DPA 2018, which provides:

“(1) In this Part, “the special purposes” means one or more of the following— (a) the purposes of journalism; (b) academic purposes; (c) artistic purposes; (d) literary purposes. … (3) The Commissioner may make a written determination, in relation to the processing of personal data, that— (a) the personal data is not being processed only for the special purposes; (b) the personal data is not being processed with a view to the publication by a person of journalistic, academic, artistic or literary material which has not previously been published by the controller. (4) The Commissioner must give written notice of the determination to the controller and the processor. (5) The notice must provide information about the rights of appeal under section 162. (6) The determination does not take effect until one of the following conditions is satisfied – (a) the period for the controller or the processor to appeal against the determination has ended without an appeal having been brought, or (b) an appeal has been brought against the determination, and – (i) the appeal and any further appeal in relation to the determination has been decided or has otherwise ended, and (ii) the time for appealing against the result of the appeal or further appeal has ended without another appeal having been brought.” (a) the purposes of journalism; (b) academic purposes; (c) artistic purposes; (d) literary purposes. … (a) the personal data is not being processed only for the special purposes; (b) the personal data is not being processed with a view to the publication by a person of journalistic, academic, artistic or literary material which has not previously been published by the controller. (a) the period for the controller or the processor to appeal against the determination has ended without an appeal having been brought, or (b) an appeal has been brought against the determination, and – (i) the appeal and any further appeal in relation to the determination has been decided or has otherwise ended, and (ii) the time for appealing against the result of the appeal or further appeal has ended without another appeal having been brought.”

[24]Section 156 was enacted as part of a suite of provisions dealing with “special purposes” processing that was intended to give effect to the UK's obligations under Article 85 GDPR (and subsequently Article 85 UK GDPR). Article 85 recognises that protection of personal data is not an absolute right and must be balanced against the fundamental right to freedom of expression and information.

[25]Article 85 UK GDPR provides, insofar as relevant:

"For processing carried out for journalistic purposes or the purpose of academic artistic or literary expression, the Secretary of State may provide for exemptions or derogations from Chapter II (principles), Chapter III (rights of the data subject), Chapter IV (controller and processor), Chapter V (transfer of personal data to third countries or international organisations), Chapter VI (the Commissioner) and Chapter IX (specific data processing situations) if they are necessary to reconcile the protection of personal data with the freedom of expression and information."

[26]The particular vulnerability of children is acknowledged in Recital 38 to the UK GDPR:

"Children merit specific protection with regard to their personal data, as they may be less aware of the risks, consequences and safeguards concerned and their rights in relation to the processing of personal data. Such specific protection should, in particular, apply to the use of personal data of children for the purposes of marketing or creating personality or user profiles and the collection of personal data with regard to children when using services offered directly to a child…"

[27]Recital 58 of the UK GDPR, which concerns the need for transparency, recognises that children merit special protection in this regard:

"The principle of transparency requires that any information addressed to the public or to the data subject be concise, easily accessible and easy to understand, and that clear and plain language and, additionally, where appropriate, visualisation be used. Such information could be provided in electronic form, for example, when addressed to the public, through a website. This is of particular relevance in situations where the proliferation of actors and the technological complexity of practice make it difficult for the data subject to know and understand whether, by whom and for what purpose personal data relating to him or her are being collected, such as in the case of online advertising. Given that children merit specific protection, any information and communication, where processing is addressed to a child, should be in such a clear and plain language that the child can easily understand."

[28]Article 8 of the UK GDPR provides for an additional safeguard in relation to the processing of the personal data of underage children:

"Article 8 Conditions applicable to child's consent in relation to information society services 1 Where point (a) of Article 6(1) applies, in relation to the offer of information society services directly to a child, the processing of the personal data of a child shall be lawful where the child is at least 13 years old. Where the child is below the age of 13 years, such processing shall be lawful only if and to the extent that consent is given or authorised by the holder of parental responsibility over the child. 2 The controller shall make reasonable efforts to verify in such cases that consent is given or authorised by the holder of parental responsibility over the child, taking into consideration available technology. 3 Paragraph 1 shall not affect the general contract law as it operates in domestic law such as the rules on the validity, formation or effect of a contract in relation to a child. 4 In paragraph 1, the reference to information society services does not include preventive or counselling services."

[29]Articles 12 and 13 of the UK GDPR set out information and transparency requirements:

"Article 12 Transparent information, communication and modalities for the exercise of the rights of the data subject 1. The controller shall take appropriate measures to provide any information referred to in Articles 13 and 14 and any communication under Articles 15 to 22 and 34 relating to processing to the data subject in a concise, transparent, intelligible and easily accessible form, using clear and plain language, in particular for any information addressed specifically to a child…” "

Article 13 Information to be provided where personal data are collected from the data subject 1 Where personal data relating to a data subject are collected from the data subject, the controller shall, at the time when personal data are obtained, provide the data subject with all of the following information: …" Analysis The parties made wide-ranging arguments. The Upper Tribunal considered the documents in the appeal bundles as well as the parties' skeletons, their oral submissions and the authorities to which they referred at the hearing. In the interests of brevity, the Upper Tribunal gives reasons only in relation to the matters it considered necessary to decide, and does not seek to address every argument raised by the parties. Grounds 2 and 4 Section 156 DPA 2018

Analysis

[30]Grounds 2 and 4 both concern the proper interpretation of section 156 DPA 2018. DPA 2018 established a scheme for the protection of the rights of data subjects that empowers the Commissioner, an independent expert regulator, to take action to enforce those rights including by imposing monetary penalties on controllers who have breached such rights (as did its predecessor DPA 1998). While primary responsibility for regulatory decisions rests with the Commissioner, and not the courts, the scheme provides for rights of appeal against decisions of the Commissioner to the First-tier Tribunal.

[31]Section 156 DPA 2018 forms part of a suite of special purposes provisions enacted within DPA 2018, to implement Article 85 of the UK GDPR (as its predecessor, DPA 1998, had sought to implement Article 9 of Directive 95/46/EC (the "1995 Directive")).

[32]Article 85 UK GDPR provides for the making of exemptions or derogations "if they are necessary to reconcile the protection of personal data with the freedom of expression and information". That wording restricts derogations such as section 156 to situations in which they are “necessary” to reconcile protection of personal data with freedom of expression and information. It suggests a narrow interpretation of exemptions or derogations, so they apply only where “necessary”. The special purposes provisions represent Parliament's attempt to reconcile the need to protect individuals' data rights with the need to protect the competing fundamental rights to free expression in the context of journalistic, artistic, literary and academic expression.

[33]Section 156 imposes additional procedural requirements which must be complied with before the Commissioner may issue a penalty notice. While section 156 does not take processing for the "special purposes" outside the scope of regulation entirely, it conditions how the Commissioner's enforcement powers may be exercised. The conditions include that a court must have granted leave for a penalty notice to be given before it is issued.

[34]The Upper Tribunal's attention was directed to Stunt v Associated Newspapers Ltd (Information Commissioner intervening)

[2018] 1 WLR 6060

(“Stunt”), in which the Court of Appeal considered the legislative intent behind the enactment of the stay provisions in section 32(4) and (5) DPA 1998 (the predecessor provisions to section 176 DPA 2018). The Court of Appeal appended to its judgment some extracts from the parliamentary proceedings relating to the passage of what became DPA 1998. These passages provide helpful insight into the concerns that Parliament was seeking to address in derogating from the normal regulator-directed procedure and involving the courts.

[35]It is clear from the passages quoted from Lord Williams of Mostyn (at 6086 D-G) that the legislators' focus was on those creating and publishing journalistic, artistic or other special content:

"We do not wish, and would not want, to inhibit the freedom of expression which is a fundamental and continuing part of the British way of life and which British broadcasters have enjoyed up to now in making programmes in a generally responsible way. It is clearly part of that tradition of information, the dissemination of views and discussion of ideas; for example, historical programmes dealing with analysis of the past. It is not the intention of the Government in implementing the Directive that the making of these programmes should be inhibited or prevented by individuals attempting to use its provisions to re-write history or prevent the responsible discussion of historical subjects and documentaries which are an important part of the media's role in informing, educating and stimulating public discussion. Equally, it is part of the British tradition of freedom of expression that entertainment programmes, such as arts programmes, comedy, satire or dramas, can refer to real events and people. It is not the intention of the Government for the Directive to be used to inhibit programme-makers from making programmes as they have up to now. The Government believe that both privacy and freedom of expression are important rights and that the Directive is not intended to alter the balance, which is a fine one and always should be, that currently exists between these rights and responsibilities…"

[36]The 1995 Directive, GDPR and DPA 1998 were enacted when the world of digital processing was in its relative infancy. Online platforms hosting third party content that might include journalistic, academic, artistic or literary content may not have been specifically contemplated by Parliament when DPA 1998 was being enacted. However, by the time DPA 2018 was enacted, the internet was much more developed. Had Parliament intended that the processing of personal data by internet intermediary service providers such as TikTok should have been excluded from the operation of the special purposes provisions or that it should apply differently to them, it would surely have said so.

[37]On the natural and ordinary meaning of the words in section 156 DPA 2018 its application depends not on the identity of the controller (who need not be a journalist, academic, artist or writer for the provision to apply), but rather on what the processing in question was "for".

[38]In NT1 and NT2 v Google LLC (Information Commissioner intervening)

[2019] QB 344

("NT1") (a case that concerned the test under section 32 of the DPA 1998, which applied only where data was processed "only for the special purposes", in contrast to section 156 DPA 2018 which omits the word "only"), Warby J (as he then was) considered whether Google, in processing data in response to a search, could fairly be considered to be processing "for the sole and exclusive purpose of enabling third parties to publish journalistic material".

[39]Warby J contemplated that a third party that facilitates the dissemination of journalistic content but does not itself create such content (such as a printer to which a newspaper has delegated the printing of its paper) might nonetheless be said to process for the special purposes. However, he decided that on the facts of the case before him, because Google's services were not exclusively subsidiary, subservient, or ancillary to those of any publisher, its processing could not. He explained at paragraph 100:

"The reality … is that the processes of obtaining, indexing, storing, and making available information that are engaged in by an [internet search engine] are automated, and governed by computer-based algorithms. The "

All" search function is carried out indiscriminately, in the sense that the search criteria have no regard to the nature of the source publications. Searches for "news" may target a narrow range of sources. But whatever the nature of the search in question, when Google responds to a search on an individual's name by facilitating access to journalistic content about that individual, this is purely accidental, and incidental to its larger purpose of providing automated access to third party content of whatever nature it may be that it has identified and indexed and meet the search criteria specified by the user."

[40]For section 156 DPA 2018 to apply it is not necessary that the processing in question was done "solely" for the special purposes. It applies where a controller processes data for multiple purposes, as long as one of them is a special purpose. As was rightly accepted by the Commissioner and the FtT, the fact that a controller is a commercial entity and is motivated to generate a profit is irrelevant to the issue whether its processing of data was done for the special purposes (indeed in TietosuojavaItuutettu v Satakunnan Markkinapörssi Oy and Satamedia Oy (

Case C-73/07

) ("Satamedia") the CJEU accepted that processing by a commercial entity could still satisfy the "solely for the special purposes" test). Ground 2: Did the FtT err by holding that, as TikTok did not wish underage children to use its platform, its processing of their data in the delivery of the TikTok platform service to them could not be for the special purposes (or, indeed, any purpose at all)?

Ground 2:

[41]The second ground of appeal focuses on the correct application of the special purposes test in section 156 DPA 2018. As set out above, additional procedural protections apply if a proposed penalty notice is “with respect to the processing of personal data for the special purposes”. Whether section 156 DPA 2018 applies is dependent not on the legality of its processing but rather whether the processing was carried out “for the special purposes”. It is necessary to look at the specific processing involved and ascertain the purpose or purposes for which the processing was carried out.

[42]TikTok’s case was that its platform delivery processing was done "for the special purposes", namely for artistic purposes. TikTok’s case was not that all platform services were covered by section 156 DPA 2018, nor that all its processing was covered by that provision (acknowledging expressly that processing for the purposes of targeted advertising was not for any special purpose). Submissions were made based on BBC v Sugar (No 2)

[2012] 1 WLR 439

that “proximity” was relevant to the issue whether processing was for the “special purposes”. It was suggested that processing of personal data in the delivery of the platform services facilitates, and is intended to facilitate, free expression by users which can properly be characterised as artistic expression. That was sufficiently proximate to be "for" the special purposes. Further, it was submitted that "directness of purpose" was also important, and there was sufficient directness of purpose in respect of TikTok's platform delivery processing because that processing was "fundamental to allowing users to access the TikTok service and create or appreciate the artistic content which it is designed to disseminate" (see paragraph 98 of TikTok's skeleton).

[43]The Upper Tribunal does not find the “proximity” test articulated by Lord Walker in BBC v Sugar (No 2) (at paragraph 83) to assist in understanding the applicability or otherwise of section 156 DPA 2018 to the processing covered by the MPN. While BBC v Sugar (No 2) concerned the free expression concept of journalism, it was decided under a materially different statutory scheme (the Freedom of Information Act 2000) and it was expressed in materially different language. Neither does the Upper Tribunal find a “directness of purpose” test of assistance, because what must be applied is the wording of section 156 DPA 2018. Neither concept is relevant to a determination whether processing was “for the special purposes”. Parliament could have chosen to require that the processing was “connected with the special purposes” or indeed “closely connected with the special purposes”, but it did not. As Lord Hoffmann cautioned in Moyna v Secretary of State for Work and Pensions

[2003] UKHL 44

[2003] 1 WLR 1929

(“Moyna”):

“It is because of the nature of language that, in trying to ascertain the legislator’s meaning, it is seldom helpful to make additions or substitutions in the actual language he has used” (see paragraph 24). Parliament chose to require that the processing be “for the special purposes” if the processing is to be subject to the derogation in section 156 DPA 2018. That is the clear test that must be applied.

The meaning of “for”

[44]Section 156 DPA 2018 applies where the processing in question was “for the special purposes". Applying its ordinary everyday meaning, the word "for" connotes deliberate intention. That is important for reasons that will become clear.

[45]Whether TikTok’s processing was carried out for artistic purposes depends both on the meaning of artistic purposes and on whether the relevant processing was done in furtherance of those purposes.

The meaning of “artistic”?

[46]Before the FtT, TikTok adduced evidence from Professor Abell, an expert in the Philosophy of Art at the University of Oxford, who reviewed the one hundred most-viewed videos on TikTok’s service during the relevant period. She gave evidence as to what proportion of those videos she considered to constitute or represent "art" (a little under half), and about the features that in her opinion tended to indicate that something was artistic in nature. The FtT did not make findings based on her evidence because it considered that it was beside the point. The FtT said the issue it had to decide was not whether the material that users posted on the site was "art" or not, but whether the processing with respect to which the MPN was given was "for the special purposes". It was quite right about that.

[47]However tempting it might be in the light of cases such as Hensher v Restawile Upholstery

[1976] AC 64

and Lucasfilm Ltd v Ainsworth [2008] ECDR 17, there is no need for the Upper Tribunal to be drawn into consideration of the question "what is art?" That is because TikTok's witness of fact before the FtT, Mr Stafford (who was then TikTok's Global Head of Content and now Global Head of Operations), accepted that "[t]here is no concept of artistic expression in the way the content recommendation system works" (see the FtT transcript of Mr Stafford's evidence at page 1124 of the UT Supplemental Bundle).

[48]When section 156 DPA 2018 is considered in the context of automated processing such as that done by TikTok, the element of "intention" connoted by the word "for" cannot simply be ignored. Instead, it must be understood in terms of what the automated system is capable of and what it is programmed to do.

[49]As Mr Stafford explained in his evidence to the FtT (see paragraphs 114 et seq. of his witness statement at page 575 of the UT Supplemental Bundle) TikTok's recommender system comprises software code that uses machine learning models and logic-based rules to direct content to users’ personalised feeds.

[50]Before the FtT Mr Stafford explained that TikTok's recommender system "advantaged" content that had been created using TikTok's content creation and editing tools. Ms Proops KC argued that the use of TikTok’s tools in creating or editing content was a reliable proxy for whether the content was artistic in nature or not, so by advantaging such content it effectively promoted artistic content. However, in his evidence to the FtT Mr Stafford accepted (see the FtT transcript at page 1126 of the UT Supplemental Bundle) that TikTok's tools could be used to create non-creative content as well as creative content. Mr Stafford preferred to speak of whether content was "creative" rather than "artistic" as he denied any expertise in art, but given the requirement in Recital 153 of UK GDPR and paragraph 56 of Satamediathat free expression notions be interpreted broadly, the Upper Tribunal proceeds on the basis that what Mr Stafford refers to as “creative” content is likely also to be artistic. While Mr Stafford explained that use of TikTok’s tools was a factor that “inputs into the distribution logic” of TikTok's recommender system (“advantaging” such content), the recommender system had no way of identifying which content employed the tools to creative ends and which did not (see the FtT transcript of Mr Stafford's evidence at page 1126 of the UT Supplemental Bundle). The Upper Tribunal is not persuaded that the use of TikTok's editing tools is a reliable proxy for whether content is "artistic" (or indeed "creative") in nature.

[51]It is apparent from Mr Stafford’s evidence that when the recommender algorithm directs content to a user's feed it does so not on the basis that the content is artistic (it being “unaware” whether the content is artistic or not), but instead based on whether the data it holds about the user's stated preferences (indicated by the user as part of the account set-up process) and past interactions with the platform (liking, commenting on, sharing, bookmarking the content, or following whomever posted it), suggest that the user is likely to be interested in it and likely to engage with it.

[52]Content that is uploaded to the platform by users may or may not be "artistic". Whether a user shares artistic or non-artistic content on the platform is determined by the user, not by TikTok or by the recommender system.

[53]However TikTok might see itself, and whatever its mission statement (to “inspire creativity and bring joy”) or aspirations might be, the relevant “purpose” for section 156 DPA 2018 is the purpose of the processing itself, not the broader aspirations or values of the controller. To fall within section 156 DPA 2018 it is not sufficient that the processing facilitates, or is associated with, the dissemination of material that itself has special purposes characteristics. Processing is “for the special purposes” only where the purpose of the relevant processing is itself journalistic, academic, artistic or literary.

[54]TikTok’s system cannot identify whether content is artistic or not. It does not (and cannot) use the presence or absence of artistic characteristics as a criterion for distributing content. It distributes content to users instead according to the algorithm’s prediction of whether and to what extent a particular user will engage with that content, irrespective of its artistic or non-artistic nature. This is dispositive of TikTok's case on section 156 DPA 2018, not only in relation to the processing of the data of underage children but also in relation to its "platform delivery processing" to all users.

[55]The Upper Tribunal finds that TikTok’s "purpose" in processing users’ data in delivery of its service is to publish users’ video content to the platform and to distribute it to users whom the algorithm predicts are likely to engage with it. Even when the system shares a video that is artistic or has artistic features it cannot do so for an artistic purpose because it is unaware of, and indifferent to, the artistic character of what it is sharing. TikTok is not therefore processing "for the special purposes" (even as a subsidiary purpose), even if much of the content hosted on the app is itself artistic. That conclusion is sufficient to dispose of Ground 2.

Underage children

[56]When considering the processing of the data of underage children there is an additional reason for finding that such processing was not "for the special purposes": in his evidence before the FtT Mr Stafford conceded that “under 13s are not welcome on the platform” and were “not meant to be on the platform” (see the FtT transcript at page 1133 of the UT Supplemental Bundle). Given that position, it is clear that none of the purposes for which TikTok processed data during the relevant period can have involved enabling the free expression of underage children through use of the platform.

[57]Before moving on, it is appropriate to say something about the submission that contract law might be of assistance in analysing the applicability of section 156. It was submitted that a fraudulent misrepresentation would render a contract voidable at the election of the innocent party but not void. The innocent party would have a right to rescind but could elect to affirm and sue for breach. Hearing matters put in this way demonstrated to the Upper Tribunal how inapposite the contractual analogy relied on by TikTok is: the "fraudulent parties" in this case are underage children seeking access to the site, and the "innocent party" is a commercial entity which has made the operational and commercial choice not to require corroboration of users' warranted age with the consequence that large numbers of underage children accessed the platform during the relevant period.

Did the FtT err in law?

[58]Ground of appeal 2 is predicated on the assertion that the FtT held that, as TikTok did not wish underage children to use its platform, its processing of their data in the delivery of the TikTok platform service to them could not be for the special purposes (or, indeed, any purpose at all). However, the FtT did not make any finding that the processing was for no purpose at all. While it referred to being persuaded by the Commissioner’s argument, what it actually found is at the end of paragraph 154 and in paragraph 155. The key findings are that “whilst we noted TikTok’s arguments about the purpose of its service being to facilitate creativity, its purpose and intention was never to do so for the underage children at any time. It follows therefore that TikTok’s processing in relation to underage children, which was the processing with respect to which the MPN was issued, was not for the special purposes”. That is not the same as the FtT finding the processing was for no purpose at all.

[59]Even if TikTok’s characterisation of the FtT’s findings were apt, such error of law would not be material because had the FtT not erred it would have been bound to come to the same conclusion that the Upper Tribunal has: the processing covered by the penalty notice is not for the special purposes. Ground 2 is dismissed. Ground 4: Did the FtT err by failing to read and give effect to s.156 compatibly with the ECHR rights of TikTok and its users?

Ground 4:

[60]Ms Proops KC argued that Article 10 free expression rights are "intensively engaged" in the case of online platforms hosting third party content such as TikTok, because such platforms invite and then enable free expression at scale, thereby democratising free expression. She said Article 10 afforded TikTok very weighty rights and the FtT erred by failing to interpret section 156 DPA 2018 through the lens of those very weighty rights not only of TikTok but also of its users, as it was required to do by the interpretative duty imposed by section 3 of the HRA 1998. It should have given a wide interpretation to the word “for” and found that TikTok’s processing was for the special purposes. The Commissioner, on the other hand, argues that the FtT carefully considered the role of Article 10 rights, and its conclusions were right for reasons it gave.

[61]In Osborn v The Parole Board

[2013] UKSC 61

, Lord Reed cautioned against treating human rights protection as a distinct area of law based on Strasbourg case law when it permeates our domestic legal system: "56. The values underlying both the Convention and our own constitution require that Convention rights should be protected primarily by a detailed body of domestic law. The Convention taken by itself is too inspecific to provide the guidance which is necessary in a state governed by the rule of law. As the European court has said, "a norm cannot be regarded as a 'law' unless it is formulated with sufficient precision to enable the citizen to regulate his conduct" (Sunday Times v United Kingdom

(1979) 2 EHRR 245

, 271). The Convention cannot therefore be treated as if it were Moses and the prophets. On the contrary, the European court has often referred to "the fundamentally subsidiary role of the Convention" (see eg Hatton v United Kingdom

(2003) 37 EHRR 611

, para 97)".

[62]The domestic law seeking to give effect to Convention rights in issue in this case is section 156 of the DPA 2018. The starting point is to construe and apply that provision, against the background already set out above, including that restrictions are only to be imposed where “necessary”. While it is well-established that free expression concepts such as journalism are to be interpreted broadly (per Recital 153 GDPR: "In order to take account of the importance of the right to freedom of expression in every democratic society, it is necessary to interpret notions relating to that freedom, such as journalism, broadly", and see also paragraph 56 at page 972 of Satamedia), that does not mean that the derogation provided for in section 156 DPA 2018 must be given a broad interpretation. There is no inconsistency in giving free expression concepts a broad interpretation while construing the wording of section 156 DPA 2018 itself according to its terms and those of Article 85 UK GDPR. That is because of the balance of rights inherent in the Convention.

[63]The construction obligation under section 3 HRA 1998 does not require section 156 of the DPA 2018 to be read in an expansive way that maximises the protection given to certain Convention rights and minimises others. Many legislative provisions bring into play multiple Convention rights and they often pull in different directions. That is the case here, where the Article 8 rights of those using the service, and the Article 10 rights both of TikTok and of those same users seeking to express themselves by what they create, share, watch and react to, come into play. The words Parliament chose must be given their ordinary meaning (viewed in their context) unless the result of doing so is that inadequate protection is afforded to Convention rights.

[64]TikTok argued that regulatory enforcement in relation to matters such as age gating has implications for the ability of those who are over thirteen years old to enjoy their free expression rights, suggesting that this necessitates protection by way of the derogation in section 156 DPA 2018. TikTok submits that the MPN seeks to force it to tighten its age assurance measures by introducing a requirement that users verify, rather than simply warrant, their age, and some “of age” users might be reticent to do this, with the possible result that they are denied their free expression rights entirely. This argument ignores the fact that Article 10 rights are not absolute. Should regulatory enforcement lead to TikTok requiring users to provide verification of age, that is not an outcome that is automatically contrary to Convention rights. Article 10 rights require to be balanced against other rights, including the data rights of children, and particularly the data rights of the very vulnerable category of underage children. TikTok retains other protections in respect of penalty notices under the DPA 2018, even where the additional restrictions in section 156 do not apply.

[65]The Upper Tribunal accepts that TikTok’s platform might facilitate artistic expression and that activity on its platform may attract Article 10 protection. Nevertheless, the Upper Tribunal considers that TikTok’s argument under section 3 HRA 1998 boils down to little more than an assertion that because freedom of expression rights are important, the FtT should have found that the additional safeguards provided for in section 156 must apply to the present situation. That approach fails properly to appreciate the balance of rights inherent in the Convention and that the starting point after Osborn is the domestic law, which seeks to protect all relevant Convention rights in this area. The Upper Tribunal’s attention has not been drawn to anything in human rights law that says it is contrary to Article 10 to make additional restrictions apply only to penalty notices “with respect to the processing of personal data for the special purposes”, or that the word “for” must be interpreted in a different way from that set out above in the Upper Tribunal’s analysis of Ground 2. It does not follow from the fact that free expression is protected that acts of processing of personal data of underage children on TikTok’s platform services is processing “for” artistic purposes within the meaning of section 156 DPA 2018.

[66]The Upper Tribunal finds that the FtT did not err by failing to read and give effect to section 156 DPA 2018 compatibly with Convention rights. The FtT found that Parliament had in enacting DPA 2018 struck the balance between competing Convention rights, including Article 10 (see paragraph 98) precisely as it intended to do. It took the approach that its role was to apply the wording of section 156 DPA 2018, and in any event it did not consider that Article 10 would alter its decision on the preliminary issue before it (see paragraphs 57 and 99). The latter finding was unreasoned, and the FtT’s decision would have been improved had it explained its reasons. However, for reasons the Upper Tribunal has explained above, the FtT’s approach to section 156 DPA 2018 was consistent both with Article 85 UK GDPR and with the interpretative duty in section 3 HRA 1998. It involved no material error in law. The fourth ground of appeal is dismissed.

Conclusions on Grounds 2 and 4

[67]For these reasons, even if TikTok is correct in its position that the MPN, properly construed, was issued with respect to all the processing involved in delivering the TikTok service to users (as to which see the discussion that follows), that processing was not processing “for the special purposes” within section 156 DPA 2018. Grounds 2 and 4 therefore fail.

[68]In light of that conclusion, it is not strictly necessary to determine Grounds 1 and 3. However, because they were fully argued before the Upper Tribunal, they are dealt with briefly. Grounds 1 and 3: the processing the MPN was issued “with respect to” The proper approach to construction of the MPN

Grounds 1 and 3: the processing the MPN was issued “with respect to”

[69]The parties were agreed that the starting point for the interpretation of any document was that explained by Lord Carnwath in Lambeth LBC v Secretary of State for HCLG

[2019] UKSC 33

; 1 WLR 4317 ("Lambeth") (at paragraph 19):

"In summary whatever the legal character of the document in question, the starting point - and usually the end point - is to find "the natural and ordinary meaning" of the words there used, viewed in their particular context (statutory or otherwise) and in the light of common sense" - and to be wary of the risk of overcomplication."

[70]However, the parties differed in their understanding of what amounted to the "particular context", and so what required to be considered.

[71]Mr Facenna KC, for the Commissioner, warned against construing the MPN with "the same linguistic rigour as a statute or a contract" and said the question of what processing the MPN was issued "with respect to" could not be answered by looking at the document in isolation and confining the analysis to "the four corners of the document", as TikTok's skeleton counselled.

[72]Mr Facenna KC's understanding of the "particular context" (per Lord Carnwath's formulation in Lambeth) extended to the scope and purpose of the Commissioner's investigation, the policy concerns giving rise to the investigation and the Commissioner's own explanation of the concerns he was trying to address in his investigation and MPN. Mr Facenna KC said the FtT, an expert regulatory tribunal, was well placed to carry out such a "multifactorial assessment". He submitted (relying on Moyna) at paragraphs 20-28 and Lifestyle Equities CV v Amazon Services Ltd

[2024] UKSC 8

;

[2024] 3 All ER 93

("Lifestyle Equities"), cited by the Upper Tribunal in Information Commissioner v Experian Limited

[2024] UKUT 105 (AAC)

("Experian") at paragraph 60), that because the FtT took multiple factors into account and because the assessment of what the MPN was given "with respect to" was capable of producing more than one reasonable answer, the Upper Tribunal should interfere with the FtT's finding only if it contains some identifiable and material error of law.

[73]Ms Proops KC, for TikTok, said this was the wrong approach. She cited Bingham J (as he then was) in Andre et Cie v Cook Industries

[1986] 2 Lloyd's Rep 200

at paragraph 204:

"…Ultimately, of course, the construction of any written instrument is a question of law on which the court is entitled and bound to rule…"

[74]Since construction of the MPN was a question of law, Ms Proops KC submitted, the Upper Tribunal must construe the MPN for itself and there was no basis for the Upper Tribunal according the FtT's interpretation deference, or indeed any weight at all.

What the MPN says

[75]The MPN is a lengthy document, running to 99 pages (193 pages if its annexes are included). It begins with an "Introduction" section that provides a summary of the Commissioner's findings and his rationale for penalising TikTok the MPN:

"5. The Commissioner has found that during the relevant period: a. Each of TikTok Inc and Tik Tok Limited were controllers (and TikTok was a joint controller) in respect of personal data of users and account holders located in the UK ("

UK users"), within the meaning of section 6 DPA and Article 4(7) UK GDPR. Each of TikTok Inc and TikTok Limited, alone or jointly with others, determined the purposes and means of the processing of such personal data. b. In providing its services, TikTok processed UK users' personal data, amongst others, to support the provision and functionality of TikTok's services, and to monetise such services, including by providing targeted advertising to its UK users and by offering in app purchases. The personal data processed by TikTok of individual UK users included the following: i. name and/or username; ii. date of birth; iii. email address; iv. telephone number; v. profile information, photographs and/or profile videos; vi. content generated on the platform (such as comments, 'likes', etc.); vii. platform settings/preferences; viii. information collected through surveys, challenges and/or competitions in which the user participated; ix. information about how the user interacted with the platform and/or third party platforms, including e.g. interactions with content, ads views, videos watched and problems encountered; content 'liked' and saved by users to 'my favourites'; and users followed; x. internal user profiles detailing, amongst others, the user's preferences and interests, based on factors such as gender and age as well as their use of the platform; and/or xi. information relating to followers of users and their interactions such as 'likes'. c. This is personal data within the meaning of Article 4(1) UK GDPR because it is "information relating to an identified or identifiable natural person". The provisions of the DPA and UK GDPR apply to the processing of personal data by TikTok by virtue of section 207 [DPA 2018] and Article 3 UK GDPR. d. The Commissioner has found that TikTok failed to process the data of its UK users in accordance with certain requirements of the DPA and the UK GDPR. In particular, the Commissioner has found that TikTok infringed the following Articles of the UK GDPR during the relevant period: Article 8 UK GDPR - offering of information society services to children i. TikTok provided its services to UK users under the age of 13 and processed their personal data without consent given or authorised by the holder of parental responsibility over such child users, and without identifying any lawful basis for processing other than consent. Whilst TikTok purports to rely, in part, on contractual necessity as its lawful basis for processing the personal data of children under 13, the Commissioner considers that the legal test for contractual necessity is not met in this case. ii. In addition, TikTok failed to make reasonable efforts to ensure that consent was given or authorised for underage child users of its video sharing platform, and/or to prevent children under 13 from accessing its services (in circumstances where it relied upon such services being restricted to users over the age of 13). Article 12 UK GDPR - Transparent information, communication and modalities for the exercise of the rights of the data subject iii. TikTok failed to take appropriate measures to provide the information required under Article 13 UK GDPR to data subjects in a concise, transparent, intelligible and easily accessible form, using clear and plain language, in particular in relation to information addressed specifically to children. Article 13 UK GDPR - Information to be provided where personal data are collected from the data subject iv. TikTok failed to provide to [sic] data subjects with the information required under Articles 13(1) and (2) UK GDPR. Article 5(1)(a) UK GDPR - Lawfulness, fairness and transparency v. In failing to comply with above requirements, TikTok failed to ensure that the personal data of its UK users was processed lawfully, fairly and in a transparent manner, in breach of Article 5(1)(a). 6. The Commissioner has decided to impose a penalty in respect of the above infringements on the basis that, having regard to the matters listed in Articles 83(1) and (2) UK GDPR, a financial penalty is an effective, proportionate and dissuasive measure."

[76]That summary is expanded upon in considerable detail later in the MPN. Breach of Article 8 is dealt with in paragraphs 36-111, breach of Articles 12 and 13 is dealt with in paragraphs 112-154 and breach of Article 5(1)(a) is dealt with in paragraphs 155-159.

TikTok’s case on “platform delivery processing”

[77]TikTok argued that the processing activities attacked by the Commissioner in the MPN were inherent in TikTok's delivery of the service to all TikTok's users during the relevant period, and the processing of the data of underage children using the service could not be disentangled from the processing of the data of those users who had reached the age of thirteen. In other words, because the processing attacked by the MPN was "platform delivery processing", that processing necessarily extended to the processing of the personal data of all users of the service.

[78]The FtT rejected this argument on the basis that TikTok's argument ignored that TikTok's terms of service did not permit underage children to use the service, so it could not be said that the processing activities attacked by the MPN were in relation to a service being delivered to all its 'users' "as children under the age of thirteen are not permitted to be 'users'" (see paragraph 111 of the FtT Decision).

The Upper Tribunal’s approach to interpretation of the MPN

[79]The Upper Tribunal agrees with the parties that the proper approach to interpreting the MPN is that set out by Lord Carnwath in Lambeth (paragraphs 16-19). The Upper Tribunal does not consider the circumstances of this case to require the kind of "multifactorial assessment" described in Lifestyle Equities (paragraph 46) and does not consider the circumstances of this case to be equivalent to those with which the First-tier Tribunal wrestled in Experian. The Upper Tribunal is not asked to "interfere with … primary findings of fact, [or] the evaluation of those facts and inferences to be drawn from them" (Lifestyle Equities at paragraph 48, citing Lewison LJ in Fage UK Ltd v Chobani UK Ltd

[2014] EWCA Civ 5

at paragraph 114). In these circumstances, the Upper Tribunal does not feel bound to defer to, or to give any weight to, the FtT's judgment on the meaning of the MPN.

[80]The Upper Tribunal accepted Ms Proops KC’s submission that in order to determine whether the FtT erred in law in its interpretation of the MPN the Upper Tribunal must construe the MPN for itself. Construction of the MPN is an objective legal question that must be determined in accordance with the usual legal principles of interpretation.

[81]The Upper Tribunal has read the MPN and its annexes together and as a whole. It has considered the "natural and ordinary" meaning of the words used in their "particular context". That context includes not only where the words appear in the document and how they relate to the other words used and the surrounding syntax, but also the wider context of the terms of the statutory scheme under which the MPN was issued. Those terms include provision for an expert regulator and provision for a process for the regulator to notify an intention to issue a penalty notice, for the making of representations in relation to such a notice, and for the issuing of a written penalty notice which must include specified information (see section 155(1) and Schedule 16 DPA 2018).

[82]The Upper Tribunal is not persuaded that the "particular context" extended as far as any statement by the Commissioner outside the NOI and the MPN itself as to what he intended to give the MPN with respect to. That would be contrary to principle. Ground 1: Did the FtT err in law by construing those parts of the MPN which penalised TikTok for breach of Articles 5(1)(a) and 8 of the UK GDPR as being given only with respect to the processing of the data of underage children?

Ground 1:

[83]The Upper Tribunal does not find TikTok's "platform delivery processing" argument persuasive. It does not follow logically from the fact that all users' data is subjected to the same processing (for example, its processing in the context of age gating and content moderation) that the MPN must apply to the entirety of such processing. The panel was not referred to any provision in the statutory scheme that would prevent the Commissioner from penalising a controller or processor who processes the data of a group of individuals in respect of its processing of the data of only a subset of those individuals. Neither is there any reason in principle why the Commissioner should be prevented from doing so. The same processing may be objectionable in respect of one category of data subjects and therefore deserving of sanction, and yet unobjectionable or less objectionable in respect of others, and therefore not deserving of sanction. Neither does the scheme require the Commissioner to penalise every breach in respect of every data subject. For those reasons the Upper Tribunal does not consider that the processing of the data of underage children is inseparable from the processing of the data of those who had reached their thirteenth birthday.

[84]Ms Proops KC complained that the MPN seeks to force TikTok to "tighten the age assurance tap" to prevent underage children from accessing the service in a way that "fundamentally increases the chances that we will end up excluding of-age users from the Platform, which is an eventuality which will amount to a total deprivation of the ability of those of-age users to use the Platform to express themselves artistically" (per Ms Proops KC at page 63 of the UT Day 1 transcript). She says it is "unreal" for the Commissioner to say that the MPN is given only in relation to underage children because compliance with it would inevitably affect all its users.

[85]The Upper Tribunal is not persuaded that just because compliance with the MPN might have consequences for users who are not underage children, the MPN must be said to be given "with respect to" the processing of the data of those users. It simply does not follow.

The MPN as it relates to breach of Article 8

[86]The Upper Tribunal finds that the passages of the MPN that relate to breach of Article 8 UK GDPR, whether in the summary section in paragraph 5 or elsewhere in the document, relate to TikTok's processing of the data of underage children only. That is hardly surprising since Article 8 is a provision that is concerned with affording special protection to underage children.

[87]Article 8(1) imposes a requirement that where consent is relied upon as the basis for processing under Article 6 of the UK GDPR the direct offering of information society services (which TikTok accepts includes the service) to an underage child will be lawful only where consent has been given or authorised by the holder of parental responsibility. This special protection reflects the particular vulnerability of underage children.

[88]Given that the Upper Tribunal rejects TikTok's "platform delivery processing" argument, it finds that to the extent that the MPN was given with respect to breach of Article 8 UK GDPR, it was given with respect to the processing of the personal data of underage children only, and not with respect to the processing of the personal data of other users.

The MPN as it relates to breach of Article 5(1)(a)

[89]While Article 8 deals specifically with underage children, Article 5 is a general provision that sets out the principles applicable to the processing of the personal data of any data subject, breach of which renders processing unlawful.

[90]The description of the breach of Article 5(1)(a) in paragraph 5(d)(v) of the MPN permits a broad reading:

"In failing to comply with above requirements, TikTok failed to ensure that the personal data of its UK users was processed lawfully, fairly and in a transparent manner, in breach of Article 5(1)(a)."

[91]It refers to TikTok's "UK users" without limiting its scope to underage children. Indeed, it does not refer to them at all. However, it refers back to the breaches of the "above requirements", i.e. the breaches identified in relation to Articles 8, 12 and 13 and it must be read in that context.

[92]The breaches of Article 5(1)(a) that the Commissioner found to have occurred are explained in more detail in paragraphs 155-159 of the MPN, which are reproduced in full:

"155. In order to comply with Article 5(1)(a) UK GDPR, a data controller is required to process data "lawfully, fairly and in a transparent manner in relation to the data subject."

Article 5(1)(a) must be interpreted, inter alia, in light of Recitals 38 and 58 UK GDPR which emphasize the special protections required in relation to children's personal data, including in respect of transparency. 156. Article 5(2) UK GDPR states:

"The controller shall be responsible for, and be able to demonstrate compliance with, paragraph 1 ('accountability')" 157. For the reasons explained above, the Commissioner has found that TikTok failed to fairly and lawfully process the data of users during the relevant period, with particular reference to child users. In particular, TikTok failed adequately to restrict access [to] its platform to users under 13 years of age, meaning that children who were too young to use TikTok without parental consent were able to do just that. 158. Insofar as TikTok relied on contractual necessity as a basis for its processing of the personal data of UK users under the Age of 13, it failed to have in place a lawful basis for such processing, which was therefore in breach of Article 5(1)(a). 159. Moreover, TikTok's Privacy Policies and transparency information, and the communication of such information to its users - including child users - fell short of the standards required under UK GDPR. In particular, TikTok failed to provide requisite information about the way in which users' personal data was processed in a manner that could be understood by data subjects. Especially for child users this meant that they were provided with insufficient and inadequate information suited to their age and ability to allow them to make informed choices about whether and how to engage with the platform. Similar shortcomings affected TikTok's Terms of service, which throughout the relevant period were so difficult for user[s] (and particularly child users) to access/understand as to render the processing of such users' data unfair, in breach of Article 5(1)(a) UK GDPR."

[93]Although some of the language in this passage describing the breach of Article 5(1)(a) found by the Commissioner is general in nature, the discussion begins with a reference to Recitals 38 and 58 UK GDPR and their emphasis on the requirement for special protection to be afforded to the personal data of children. Those references provide context for what follows. While general language is used that on its face might apply to all users (e.g. "TikTok failed to fairly and lawfully process the data of users during the relevant period" (see paragraph 157 of the MPN)), the identified breach is tied back to users who are children (e.g. "with particular reference to child users").

[94]While it is possible to read paragraphs 157 and 158 of the MPN as applying to TikTok's processing of the data of all its UK users (but with a special emphasis on its processing of children's data), the Upper Tribunal prefers a narrower interpretation: in this passage the MPN first identifies the general category of breach (the unlawful processing of personal data), and then particularises it (the unlawful processing of the personal data of children). It then particularises the breaches further, identifying the specific failings penalised by the MPN:a. inadequate age gating, which had the consequence that underage children used the service with the further consequence that their personal data was processed by TikTok notwithstanding that consent had not been given or authorised by the holder of parental responsibility; and

b. processing of the data of underage children without having a lawful basis for claiming contractual necessity.

[95]Paragraph 159 of the MPN follows the same pattern as paragraphs 157 and 158: it begins with a general statement to the effect that its transparency policies, the information it provided and the way it provided it, were deficient. It then particularises the breach ("failed to provide requisite information about the way in which users' personal data was processed in a manner that could be understood by data subjects").

[96]Unlike in paragraphs 157 and 158, which particularise the breach by reference to the category of users it relates to, this breach is particularised by reference to the nature of the breach and remains at the level of all users. However, it goes on to provide further specificity, this time by reference to the category of user, i.e. "child users".

[97]The language used ("especially") differs from that used in paragraphs 157 and 158 ("with particular reference to"; "[i]n particular"). If one says that something is "especially" the case for a particular category of person, that does not necessarily exclude that it may also be the case for another category of person. Indeed, it suggests that it is the case for one or more other categories of person, albeit to a lesser degree.

[98]This gives rise to the issue whether paragraph 159 therefore applies to the processing of the data of all TikTok's UK users in the context of a breach of its information and transparency obligations under Articles 12 and 13 UK GDPR. While the drafting of paragraph 159 of the MPN could be improved, the Upper Tribunal interprets this passage, when read "in its particular context", as identifying information and transparency failings on a platform-wide basis affecting all users. However, as discussed below, those alleged failings are not processing failings and do not therefore widen the processing in respect of which the MPN was given beyond the processing of the personal data of underage children. This is because when the MPN is read as a whole, it is adequately clear that the processing with which the Commissioner was concerned was the processing of the personal data of underage children only, and not the processing of the data of users who had reached their thirteenth birthday.

[99]TikTok placed considerable emphasis on paragraph 5 of the MPN to support its case that the MPN was given with respect to the processing of the personal data of all users, and not just underage children. That paragraph appears under the heading “Introduction”. As the FtT rightly observed, that section serves the function of explaining the factual background to the giving of the MPN and describing TikTok and its platform generally. The fact that paragraph 5 discusses TikTok’s processing generally does not mean that every later finding and sanction relates to the totality of the processing described in that introduction.

[100]Similarly, paragraph 174 of the MPN, on which TikTok places significant reliance as justification for reading the MPN as given with respect to TikTok’s processing of the data of all users, is not framed as a specification of the breaches with respect to which the MPN was given. Rather, it appears as part of the Commissioner’s engagement with representations advanced by TikTok in response to the NOI. It represents an attempt to engage with TikTok’s representations and does not define the subject matter of the notice.

[101]If (as is hinted in the FtT's refusal of permission to appeal but is not apparent from the FtT Decision itself) the FtT relied on evidence as to what the Commissioner said he intended the MPN to cover rather than its own analysis of the words of the MPN in their particular context, that was the wrong approach (see Bahamas International Trust Co Ltd v Threadgold

[1974] 1 WLR 1514

per Lord Diplock at 1525, in the context of the construction of a contract, but equally applicable in principle to the construction of the MPN) and was an error of law. However (having construed the MPN for itself) the Upper Tribunal finds that those parts of the MPN which penalised TikTok for breach of Articles 5(1)(a) and 8 of the UK GDPR were given only with respect to the processing of the data of underage children. Had the FtT not erred in its approach it would have been bound to come to the same conclusion. Any such error was not therefore material. Ground 1 is dismissed. Ground 3: Did the FtT err in law in holding that the parts of the MPN penalising TikTok for breaches of Articles 12 and 13 were not given with respect to the processing of personal data at all, but rather in relation to procedural obligations? TikTok’s ‘lex specialis’ argument

Ground 3:

[102]Ms Proops KC said the FtT erred in law because it failed to appreciate that Articles 12 and 13 UK GDPR are lex specialis to the transparency requirement in Article 5(1)(a) UK GDPR. She submitted that Article 5(1)(a) is directed at achieving transparency of processing, and Articles 12 and 13 impose specific rules to serve that objective, with a view to ensuring that the data controller achieves transparency in its processing of personal data.

[103]Ms Proops KC relied upon the "strongly persuasive" authority of Meta Platforms Ireland C-757/22

[2025] 4 WLR 3

as support for her argument that findings that a controller has breached Articles 12 and 13 "inevitably concern - and are thus made with respect to - the processing of all personal data by a controller" (see paragraph 57(4) of TikTok's skeleton). She maintained that breaches of Articles 12 and 13 could not be dismissed as merely "procedural", as the Commissioner sought to do. Rather, they were substantive. She said that if a controller fails to provide the information required by Article 13 about its data processing, and to do so in the manner required by Article 12 (i.e. in a concise, transparent, intelligible and easily accessible form) then the substantive processing activities of the controller will themselves be unlawful, and will breach Article 5(1)(a). In other words, "the procedural failure is inevitably and inextricably intertwined with the underlying processing: the two go hand in hand" (TikTok skeleton paragraph 57(5)).

The Commissioner's position

[104]Mr Facenna KC maintained that the FtT was right to find the obligations imposed by Articles 12 and 13 UK GDPR to be procedural in nature and to find that, to the extent that the MPN concerned those provisions, it was given with respect to breach of those procedural obligations only, and not with respect to any unlawful processing carried out as a result of those breaches.

The Upper Tribunal’s analysis on Ground 3

[105]Article 13 sets out requirements for information to be provided where personal data are collected from a data subject. Article 12 sets out requirements for the manner and modality of information that must be provided pursuant to Article 13. Articles 12 and 13 are not merely specific rules implementing a more general obligation of transparency in Article 5(1)(a). Rather, they are complementary provisions.

[106]Compliance with the requirements for information to be provided (and provided in an appropriately transparent manner) may well be the route to compliance with Article 5(1)(a)'s requirement that personal data be processed lawfully, fairly and in a transparent manner. A breach of Article 12 or 13 may, therefore, flow through to a breach of Article 5(1)(a) as and when relevant processing occurs, but that does not mean that a breach of Article 12 or 13 is itself a processing breach, or that a penalty given with respect to a breach of Article 12 or 13 is made "with respect to" processing. A penalty for a processing breach concerning lack of transparency is given under Article 5(1)(a), not Article 12 or 13.

[107]Sections 149 and 155 of the DPA 2018 permit the Commissioner to issue a penalty notice in respect of any failing described in section 149(2), (3), (4) or (5) DPA 2018. That power is not restricted to penalising processing failings. While the MPN identifies breaches of Article 5(1)(a) of UK GDPR it does not attribute any of the £12,700,000 penalty imposed on TikTok to such breaches. Rather, it attributes the penalty to the breaches of Articles 8, 12 and 13 only.

[108]The Upper Tribunal endorses the analysis set out by the FtT in paragraph 131 of the FtT Decision: "We accept TikTok's submission that Articles 12 and 13 arise in connection with the processing of personal data; it does not exist in the 'ether', any other conclusion would make no sense. However…this does not mean that Articles 12(1) and 13 regulate the processing of personal data. We do not accept that coming to this conclusion means that we are finding that the transparency obligations operate in some kind of vacuum detached from the underlying processing operation. We accept that the obligations arise in the context of a data controller engaging in processing operations but that is not the test in section 156, which operates "with respect to the processing of personal data", not the context of that processing. Rather we agreed with the [Commissioner’s] submission that 'Processing of personal data within the meaning of the UK GDPR is the backdrop to those duties, but the processing itself is not regulated by the duties imposed by those provisions. The same is true of e.g. the duty to keep records (Article 30) and the duty to appoint a data protection officer (Article 37)'".

[109]The construction proposed by TikTok would lead to consequences which cannot sensibly have been intended by Parliament. If every obligation imposed on a controller which arises in the context of processing personal data were itself to be regarded as processing “for the special purposes”, then an impossibly wide range of governance and transparency obligations under UK GDPR would come within the derogation under section 156 DPA 2018 whenever imposed on a publisher, broadcaster or online platform engaged in special purposes activity. Duties concerning information provision, record keeping, governance structures or regulatory accountability would thereby become subject to the special purposes regime merely because they arise against the backdrop of processing undertaken by those entities. Section 156 draws a much narrower distinction: it is concerned with penalty notices given “with respect to the processing of personal data for the special purposes”, not with every obligation imposed upon a controller whose activities may include special purposes processing.

[110]The Upper Tribunal has considered the passages in decisions of the CJEU in Meta Platforms Ireland andIntegritetsskyddsmyndigheten v AB StorstockholmsLokaltrafik [2025] C-422/24 (“AB”) relied on by TikTok. Meta was not concerned with a regulator’s right to enforce obligations to provide information, but rather the question of whether a group action could be brought by a consumer organisation for infringements of rights as a result of processing. The court found in Meta that “[i]n so far as processing of personal data carried out in breach of the data subject’s right to information under articles 12 and 13 of the GDPR infringes the requirements laid down in article 5 of that Regulation, the infringement of that right to information must be regarded as an infringement of the data subject’s rights “as a result of the processing”, within the meaning of article 80(2) of that Regulation.” In AB the court was concerned with the question whether information had to be provided under Articles 13 or 14 in relation to bodycams worn by ticket inspectors and decided Article 13 was the applicable provision.

[111]The Upper Tribunal finds it unsurprising that the court in Meta decided that processing that breached Article 5 by reason of failings in respect of the controller’s Article 12 and 13 duties should be considered to involve a breach of the data subject’s rights “as a result of the processing”. The Upper Tribunal accepts (as the Commissioner accepts) that breach of Articles 12 and 13 will naturally arise in the context of processing of personal data, and a breach of Articles 12 or 13 will often have the consequence that subsequent processing breaches Article 5(1)(a). However, the passages relied on in these cases do not support TikTok's proposition that a finding that a data controller has breached Articles 12 and 13 is inevitably "made with respect to" the processing of all (or indeed any) personal data by a controller. There is nothing in the authorities to cast doubt on the ability of the Commissioner to take enforcement action in respect of Article 12 or 13 breaches independently of any processing breaches. In this case the focus of the MPN, in so far as it related to Articles 12 and 13, was on defects in TikTok’s privacy notices and not on its processing of users’ data.

[112]The Upper Tribunal has read the MPN and its annexes together and as a whole, considering the "natural and ordinary" meaning of the words used in their particular context. In particular in relation to Articles 12 and 13, it has had regard to paragraphs 5, 112-154, 199, 201(iii)-(iv), 203-204, 217-227, 235, 238, 251, 256 and annex 3, against the backdrop of all the contraventions found. The Commissioner expressly separates out the issue of penalty as regards Articles 12 and 13 on the one hand, and Articles 8 and 5 on the other (paragraph 203 and elsewhere). The Upper Tribunal concludes that, to the extent that the MPN penalised TikTok for breaches of Articles 12 or 13 of the UK GDPR, the penalty was not imposed with respect to processing failings, but rather with respect to procedural failings regarding the provision of information in an appropriately transparent manner.

[113]The FtT did not err in deciding that the penalty for breach of Articles 12 and 13 was not given with respect to the processing of personal data at all. Ground 3 is therefore also dismissed. Ground 5: Did the FtT err by concluding that the MPN could potentially be upheld insofar as it concerned processing for the purposes of delivering targeted advertising even if, contrary to the FtT’s conclusions, other parts of the MPN were given with respect to processing of personal data for the special purposes?

Ground 5:

[114]Because the Upper Tribunal has dismissed Grounds 1-4 and because it confirms that the FtT did not err in determining that the MPN was not made "with respect to processing of personal data for the special purposes" within the meaning of ss.156 and 174 DPA 2018, there is no need for the Upper Tribunal to address Ground 5.

Conclusion

[115]For all these reasons the appeal is dismissed. The Honourable Lady Poole Upper Tribunal Judge Nicholas Wikeley Upper Tribunal Judge Thomas Church Authorised by the panel for issue on 28 July 2026