Alistair Sloan, Advocate

Yesterday I wrote about the decision, published last week, of the First-tier Tribunal in relation to a preliminary issue raised in TikTok’s appeal against the penalty notice issued by the Information Commissioner in 2023. In yesterday’s blog post I looked at two of the four matters that the Tribunal decided it required to determine as part of the preliminary issue. In this post, I look at the remaining two, namely (a) the Special Purposes Issue and (b) the Consequences Issue.

Special Purposes Issue

The Tribunal deals with this issue at [131]-[155] of its decision. In this part of its decision, the Tribunal considers whether the processing with respect to which the penalty was issued by the Commissioner was for the special purposes.

The Tribunal had heard evidence from three witnesses. First from James Stafford who is the Global Head of Content for TikTok. The Tribunal summaries his evidence to the Tribunal at [23]-[30] of its decision. Second from Professor Catherine Abell, who is Professor of Philosophy of Art and Fellow of Queen’s College, Oxford. The Tribunal summaries the evidence of Professor Abell at [31]-[40]. Both of these witnesses were called by TikTok. The third witness was Professor Jan Krämer, Professor of Information Systems at the University of Passau, Germany. The Tribunal summarises Professor Krämer’s evidence at [41]-[45] of its decision.

The Tribunal accepted that a broad approach required to be adopted to what is meant by the special purposes, one of which is artistic purpose. [132] TikTok accepted that not all forms of creative endeavour would qualify as being artistic in nature for the purposes of section 174(1) of the Data Protection Act 2018 (DPA2018). [134] It argued that the real question for the Tribunal in this case was how that threshold fell to be identified or characterised and it drew upon principles from copyright law for its argument. [134] TikTok argued that these principles should apply because they reflected an approach which was based on common-sense, properly recognised the limits of the court’s competence and reflected the principles approved in Tietosuojavaltuutettu v Satakunnan Markkinapörssi Oy and Satamedia Oy (Case C-73/07) that a wide and flexible approach is to be applied in respect of special purpose concepts. TikTok further argued that the opinion of Professor Abell should carry considerable weight. She had considered that 48 of 100 videos reviewed by her on TikTok were artistic.

In relation to the evidence of Professor Abell, it was argued on behalf of the Commissioner that her report did not go to any point that was in dispute before the Tribunal. In particular, it said nothing about how, or for what purpose, personal data with which the penalty was concerned was actually processed by TikTok. The Commissioner invited the Tribunal to afford Professor Abell’s opinion very little weight in the context of the preliminary issue.

The Tribunal agreed with the Commissioner’s submission that the question before the Tribunal, in this context, was not whether content posted on TikTok is artistic in nature. [137] The Tribunal stated at [137]:

Whilst the fact that content is artistic may indicate the possibility that there may be some sort of processing for an artistic purpose going on, the Tribunal’s task is to determine whether the specific processing which is the subject of the MPN was for the special purposes. The presence of some artistic content is not enough by itself to replace the need to carry out this task.

TikTok also argued that its service was one that provided a free expression service; in particular, it acted as an online intermediary service enabling tens of millions of people to exercise their free speech rights on the internet. It argued that its service was firmly and deliberately orientated towards the creative and artistic; this was in contrast to other ISPs (such as Google) which operated in a content neutral way. TikTok argued that it sought to encourage its users to create, share and consume content that is “inherently creative” and artistic. TikTok also sought to argue that it differed fundamentally from other video-sharing platforms such as YouTube. TikTok accepted that it had to meet, for the purposes of the special purposes test, something more than a vague connection with the special purposes and argued that it did so.

For the Commissioner it was argued that the processing undertaken by TikTok for the purposes of delivering targeted advertising to underage children was not processing for the purposes of journalism, or academic, artistic or literary purposes. It was contended by the Commissioner that processing by TikTok for the purposes of monetising its user base and delivering targeted advertising had no journalist or artistic purpose, it was only for a commercial purpose. The Commissioner also argued that processing by TikTok for the purpose of attempting to prevent underage children from accessing its service or for detecting and removing any underage children on its service was not processing for the special purposes; it was for the purpose of preventing underage children from gaining access to and using its platform.

The Tribunal was ultimately persuaded by the arguments advanced on behalf of the Commissioner “that by definition TikTok’s purpose in processing the data of those Underage Children cannot be to facilitate their use of its platform for any purposes at all, including any special purposes.” [152] The Tribunal concluded “that TikTok’s processing in relation to Underage Children, which was the processing with respect to which the MPN was issued, was not for the special purposes.” [153] The Tribunal stated, at [155]:

We therefore conclude that the processing of personal data by TikTok in respect of which the MPN was made was not for the special purposes. Accordingly, the IC was not required to obtain leave from a court under section 156 before issuing the MPN and the MPN was not issued ultra vires. This is because the MPN concerns – and was given “with respect to” (the language of section 156 DPA) – specific processing of data by TikTok that was not “for the special purposes”.

Comment on Special Purposes Issue

TikTok comprehensively lost on this issue, which was not unexpected in light of the Tribunal’s conclusions in relation to the first two issues. Although I was somewhat critical of the strength of one of the Tribunal’s reasons in relation to the “Processing Issue”; I do not think that criticism is in any way material to the overall conclusions of the Tribunal. The Tribunal does not seem to have been the least bit persuaded that the processing with which the penalty notice was concerned was in a deliberate or intentional way processing for the special purposes.

Consequences Issue

The Tribunal deals with this issue at [156]-[164] of its decision. This issue is fairly straightforward and is really secondary to the first three issues in light of the Tribunal’s decision. In essence, the consequence of the Tribunal’s decision is, subject to any appeal by TikTok against this decision, that the entire penalty notice falls to be determined by way of a substantive hearing. [156] The Tribunal held that because it had determined that the processing in respect of which the Commissioner had issued the penalty notice was not for one or more of the special purposes, the Commissioner did not need to follow the procedure set out in section 156 of the DPA2018 before issuing the penalty. [157]

TikTok had raised concerns in its written and oral submissions to the Tribunal about the Commissioner’s findings in the penalty notice on the targeted advertising processing, in particular that they had not been fully set out in the Notice of Intent which the Commissioner was required to issue before issuing the penalty. The Tribunal doesn’t appear to have been particularly persuaded by those concerns. It stated, at [160]:

It is frequently the case that an enforcement case brought by a regulator will evolve during the various stages of the case from how it was initially raised with the subject, often reflecting representations made by the subject. Any procedural unfairness (such as that flowing from Article 6 ECHR) which arises when the formulation of the regulator’s case changes from how it was pleaded at an earlier stage of the process (here the NOI) can be corrected by the statutory right to challenge the later iteration of the case (the MPN) by way of appeal and make representations in that context.

 Under reference to the Court of Appeal’s judgment in Financial Conduct Authority v BlueCrest Capital Management (UK) LLP the Tribunal stated that in its view the targeted advertising “has a real and significant connection with the subject matter of the MPN and therefore of the appeal.” [163] The Tribunal went on to state, at [163]:

The statutory appeals process gives an opportunity for TikTok to challenge the MPN as it stands, irrespective of what was in the earlier notice. We therefore do not accept that it would be unfair to allow the IC to rely on an MPN which has evolved out of a differently framed NOI, because the current appeal process allows TikTok to make any representations it wishes relating to the MPN, so there is no procedural unfairness.

The Tribunal concluded that it did not “accept TikTok’s argument that the IC should not be allowed to rely on the allegations around targeted advertising set out in the MPN.” [164]

Conclusion

The Tribunal having disposed of the preliminary issue and determined it wholly in favour of the Commissioner it can now, in theory, move on to deal with TikTok’s substantive appeal against the penalty issued by the Commissioner. While this was a lengthy decision, it should not be taken to mean that the Commissioner will ultimately be successful in resisting the substantive appeal by TikTok; this decision was, ultimately, about whether the penalty notice was valid or whether it was invalid because the Commissioner should have followed the procedure set out in section 156 but had not done so.

As noted earlier in this post, and my one from yesterday, TikTok could seek leave to appeal to the Upper Tribunal against the First-tier Tribunal’s decision. These are weighty issues of significant importance, not only for the operation of the Commissioner’s regulatory powers but for the basic operation of data protection law in relation to special purpose processing. I would not at all be surprised if TikTok seeks permission to appeal to the Upper Tribunal against this decision and nor would I be surprised if the issues ultimately ended up before the Supreme Court – there is, of course a long way to go before the parties reach there with lots of potential twists along the way.

In short, I do not think we will be getting a decision on the substantive appeal against the penalty anytime soon and this appeal will certainly outlive both the office of Information Commissioner and its current incumbent (in the sense that he will have long demitted office by the time these issues are finally resolved).

^{_{Disclaimer: This article is for information purposes only and nothing in it should be taken as constituting legal advice.}}

In April 2023, the Information Commissioner served a Penalty Notice, in the sum of £12.7m, on TikTok Information Technologies UK Limited and TikTok Inc (TikTok). The decision to issue a Penalty Notice and the amount of the penalty are appealable to the First-tier Tribunal and TikTok has exercised its right of appeal. Last week, the First-tier Tribunal published its decision in relation to a preliminary issue raised by the TikTok appeal. The issue concerned whether the Penalty Notice issued by the Commissioner related to processing of personal data for the special purposes within the meaning of sections 156 and 174 of the Data Protection Act 2018 (“DPA2018”). The First-tier Tribunal, on the preliminary issue, found against TikTok and in favour of the Information Commissioner.

The Tribunal’s decision on the preliminary issue runs to 165 paragraphs over 57 pages and so it is a lengthy decision. The decision itself is very much worthwhile reading in full. It should be noted that the period that the penalty notice was concerned with ended before ‘IP Completion day’; therefore we are dealing with GDPR rather than the UK GDPR. However, the Tribunal’s decision remains relevant for the purposes of the UK GDPR.

The Special Purposes

Section 174 of the DPA2018 defines the special purposes as one or more of: (a) the purposes of journalism, (b) academic purposes; (c) artistic purposes; and (d) literary purposes. Section 156 of the DPA2018 places restrictions on the Information Commissioner in relation to the issuing of penalty notices to controllers or processors where the personal data concerned was being processed for the special purposes.

Questions raised by the preliminary issue

The Tribunal sets out at [18] of its decision that it considered that there were four questions arising from the preliminary issue that it must answer. Those questions are:

1. What the scope, meaning and purpose of section 156 (which the Tribunal referred to as the “Construction Issue”).
2. What was, as a matter of fact, the processing with respect to which the penalty was issued by the Commissioner (which the Tribunal referred to as the “Processing Issue”)
3. Was the processing in respect of which the penalty issued for the purpose of one ore more of the special purposes (which the Tribunal referred to as the “Special Purposes Issue”)
4. What consequences flow from the Tribunal’s findings in relation to the first three issues (which the Tribunal referred to as the “Consequences Issue”)

In this post, to prevent it from getting too long, I will focus on the first two of these questions. A second post will follow, tomorrow, looking at the third and fourth questions.

The Construction Issue

The Tribunal deals with the Construction Issue at [46]-[97] of its decision. Under this issue, five key issues were raised (which the Tribunal sets out at [46] of its decision).

The five key issues identified under the Construction Issue were: (a) the legislative history of section 156 and what it was intended to achieve; (b) whether it matters that TikTok is a commercial entity; (c) whether section 156 can apply to an internet service provider (ISP); (d) the interaction between sections 156 and 174, including whether the processing needs to be only for the special purposes in order to fall within section 156(1) of the DPA2018; and € the interaction between section 156 and Article 10 of the European Convention on Human Rights (ECHR).

After making some general observations concerning statutory interpretation at [47], the Tribunal goes on to consider the first of the five key issues raised by the Construction Issue at [48]-[55] of its decision.

The Tribunal records at [49] that it was common ground between the parties that sections 156 and 174 were part of a suite of provisions enacted within the DPA2018 in order to implement Article 85 of the GDPR.

It was argued on behalf of TikTok that there was no hierarchy between the various special purposes. The Tribunal agreed and stated at [50] that “the special purposes as defined in the statute do not give more weight to one form of purpose than to another.”

It was argued, on behalf of the Commissioner, that section 156 was a reconciliation by Parliament of the competing rights under Article 85(1) rather than being the type of specific exemption mandated under Article 85(2). Section 156 replicates, with no material difference, what was found in section 46 of the Data Protection Act 1998 (“DPA1998”) and Parliament was seeking to reconcile the data protection rights under the GDPR with the competing fundamental rights in relation to the identified forms of expression. In doing so, Parliament created a specific procedure to be followed for regulatory enforcement in respect of those specific identified forms of expression. It was contended on behalf of the Commissioner that what became section 46 of DPA1998 and then section 156 of the DPA2018 were a careful set of checks and balances.

At [55], the Tribunal stated that it was persuaded by the arguments advanced on behalf of the Commissioner in relation to what Parliament intended. The Tribunal agreed “that Parliament had decided in enacting DPA 2018 exactly how it wished to balance the competing rights in play, including Article 10 EHCR.” [55] It also agreed with the Commissioner’s contention that it is “not for the Tribunal to second-guess this balancing exercise.” [55]

The second of the five key issues under the Construction Issue was whether it mattered that TikTok was a commercial entity. The Tribunal answered in the negative concluding that “the fact that TikTok was a commercial entity does not mean that it cannot be found to be processing personal data for special purposes within section 156.” [58]

In relation to whether section 156 could apply to an ISP, the Tribunal took issue with TikTok’s presentation of what the Commissioner was arguing, stating, at [65], that it appeared to the Tribunal

“that, contrary to TikTok’s assertions, the IC is not trying to say that section 156 can never apply to an ISP like TikTok as a matter of principle. Rather, [the Commissioner’s] position is that whether section 156 applies is fact-specific and concerns the actual processing with which the MPN in question is concerned.”

The Tribunal concluded that “it is necessary to consider the specific processing” that is the subject of a penalty; whether or not section 156 is engaged is determined by the factual context. [66] The Tribunal also concluded, at [67], that:

“Parliament did not intend section 156 to apply any differently to ISPs to the way in which it applies to other data processors. If it wished there to be a difference in how the statute should apply, that would be a matter for Parliament, not for the Tribunal.”

Therefore, the Tribunal concluded that “section 156 can apply to an ISP.” [67]

In relation to the fourth of the five key issues under the broader “Construction Issue”, the Tribunal agreed with the common position between the parties that section 156 of the DPA2018 does not require that the processing with which a penalty notices is concerned should be only for special purposes. [80] In essence, it can apply where the processing is for both special purposes and purposes other than special purposes.

The Tribunal was of the view that the special purposes regime required a narrow interpretation which is consistent with the terms of Article 9 of the GDPR which required that derogation should only be made where it was necessary. [82] Whether processing is for a special purpose is a question of fact, but that there should be a degree of intention; incidental or accidental processing is unlikely to be done for one or more of the special purposes. [82] Therefore, there must be more than an accidental or incidental connection to the special purposes for the protections in section 156 to apply. [82]

At [83] of its decision, the Tribunal stated:

“In our view, this requires a narrow and purposive approach to construing section 156. Taking into account all the evidence and the parties’ submissions we do not consider that the fact that TikTok’s stated mission and overall purpose is concerned with the encouraging of creativity and creation of artistic and journalistic content to be sufficient to render all its processing of personal data as being “for the special purposes”. Instead, in order to apply section 156 correctly, we must first establish as a matter of fact the processing concerned and then consider the question of whether it is for the special purposes in that specific context”

On the fifth of the five issues under the broader Construction Issue, the Tribunal, in line with what it had decided earlier in its decision on the Construction Issue, was “not persuaded that greater weight should be given to Article 10 by the Tribunal than was given to it by Parliament in seeking to reconcile it with the right to data protection.” [96] In the context of the preliminary issue raised in the TikTok appeal, the Tribunal is concerned with exactly what processing by TikTok the penalty related to and whether that processing was carried out for the special purposes. [96] Even if the Tribunal was wrong on this, it did not consider that Article 10 of the ECHR alters the decision it reached on the preliminary issue. [97]

Comment on the Construction Issue

Drawing all that the Tribunal had to say about the Construction Issue in its decision, the following, I think, can be said:

• Section 156 is a carefully calibrated balancing of the competing rights of protection for personal data and expression in relation to the special purposes.
• It is not for the Tribunal to second-guess the balance struck by Parliament within the legislation
• Whether section 156 applies is a matter of fact that depends upon the exact processing with which the penalty is concerned
• Section 156 can apply to an ISP such as TikTok and it does not apply differently to ISPs from any other controller or processor
• For processing to be carried out for one or more of the special purposes there must be an intention for it to be processed for special purposes; incidental or accidental processing for special purposes is not enough.

The Processing Issue

The Tribunal addresses the Processing Issue at [98]-[130] of its decision. Here three distinct matters were considered: (i) what processing the penalty notice was issued in relation to; (ii) processing for the purposes of targeted advertising; and (iii) whether the findings in relation to transparency were processing.

Under reference to paragraphs 37, 59, 62, 90, 157, 158, 177, 201(i), 201(b) and 208 of the Penalty Notice, the Tribunal concluded that the notice “read as a whole, was given in relation to the alleged unlawful processing by TikTok of the personal data of Underage Children.” [108] The Tribunal said that this was at “the very heart of the reasoning” in the notice. [108]. TikTok had sought to argue, under reference to paragraphs 5(b) and 28 of the notice, that the penalty notice concerned the processing of personal data of all of its UK users. In relation to paragraph 5(b), the Tribunal concluded that this set out the background to TikTok, how it works and the basic regularly context [100]. The Tribunal did “not find that paragraph 5 is determinative of what the MPN relates to.” [100]

In relation to paragraph 28 of the penalty notice, the Tribunal found that it “was not addressing the specific processing for which the MPN was given, it was setting out background and concerns re harmful content for children under the age of 13.” [102]

TikTok had also argued that it was impossible to divorce the notice from the processing undertaken by them for the purposes of delivering its services to its users. It argued that the processing attacked in the penalty were an integral part of delivering its services to all its users. The Tribunal was unpersuaded by this. The Tribunal noted that in terms of TikTok’s terms of service, children under the age of 13 are not permitted to be on its platform. Therefore, the Tribunal stated that it cannot be said that the processing activities attacked by the Commissioner in the penalty notice were in relation to a service being delivered to all of TikTok’s users; children under 13 are not permitted to be users of the platform. [109]

The Tribunal therefore held that those parts of the notice which dealt with what the Commissioner found to be violations of Articles 5 and 8 of the GDPR related to the processing of personal data by TikTok in relation to “Underage Children.” [110] It pointed out that whether the processing amounts to breaches of Articles 5 and 8 is outwith the scope of the preliminary issue being addressed in its decision. [110]

On the targeted advertising question, the Tribunal was “satisfied that at least some of the processing which the MPN is concerned is processing of personal data of Underage Children in connection with the provision of targeted advertising.” [115] The Tribunal held that the notice “was explicitly concerned with the processing of” targeted advertising. [116] TikTok had argued that the notice had dealt with targeted advertising only very briefly and had made no effort to identify the specific targeted advertising operations which were in issue nor any harm that flowed therefrom. These are, however, matters for the substantive hearing and went beyond what the Tribunal required to determine in the context of the hearing on the preliminary issue. [117]

In relation to the transparency matters, the Commissioner had argued that this aspect of the notice could not fall within the ambit of section 156 because that section only applies where a penalty notice is given in respect of the processing of personal data. The Commissioner argued that Articles 12(1) and 13 do not impose a duty to process personal data in any particular way rather they were concerned with information that controllers have to provide about the processing of personal data. On the other hand, TikTok had argued that the transparency obligations could not be detached from any particular processing operation that was underlying them.  They had argued that it was necessarily anchored to the processing operations to which the duty related.

The Commissioner submitted to the Tribunal that it was not for them to determine whether Article 12 and 13 could be said to relate to any processing; what section 156 required the Tribunal to consider was whether, in this case, the penalty notice was given in respect of processing of personal data for special purposes.

The Tribunal held that “the sections dealing with Articles 12 and 13 were not given in respect of breaches of processing of personal data but given with respect to breaches of procedural obligations.” [125] and [130] The Tribunal did accept, however, the submission by TikTok that Articles 12 and 13 arise in connection with the processing of personal data [129] but that, in agreement with the Commissioner’s submission, that this does not mean that Articles 12(1) and 13 “regulate the processing of personal data.” [129]

Comment on the Processing Issue

This section of the Tribunal’s decision is not one from which wider principles can necessarily be drawn as it was very much concerned with the specifics of this case rather than anything much more fundamental. There is an interesting discussion around the nature of transparency information and its relationship with processing; however, the issue for the Tribunal, at least at this stage, was a much more narrow one.

I do not think that the conclusions at [109] of the decision around children under the age of 13 who are on TikTok are not its users are particularly persuasive. That part of the Tribunal’s decision, in contrast to other aspects of it, seemed weak. The parties will have no doubt said much more to the Tribunal in submissions than was captured in the Tribunal’s decision, but regardless of that (on the assumption that the Tribunal has set out the parties’ submissions in sufficient detail to ensure that the decision is intelligible) it doesn’t seem to me to be the strongest of the Tribunal’s conclusions.

The Tribunal certainly agreed with some of TikTok’s criticisms of the parts of the notice that this issue concerned; however, it did no more than agree with the observations. What effect this has on the overall notice wasn’t a matter for the Tribunal at this stage and so we shall have to wait until the Tribunal issues a decision on the substantive aspects of the appeal to see what effect, if any, these deficiencies have in relation to the notice.

_{^{Disclaimer: This article is for information purposes only and nothing in it should be taken as constituting legal advice.}}