The ICO has proposed enforcement action against TikTok for a number of alleged GDPR breaches.
Notice of Intent
The Information Commissioner’s (ICO’s) notice of intents says that TikTok could face a £27 million fine after an investigation concluded that the TikTok may have breached UK data protection law. A ‘notice of intent’ is- a legal document that precedes a potential fine.
The notice sets out the ICO’s provisional view that TikTok breached UK data protection law between May 2018 and July 2020.
The ICO investigation found the company may have:
- processed the data of children under the age of 13 without appropriate parental consent,
- processed special category data, without legal grounds to do so, and
- failed to provide proper information to its users in a concise, transparent and easily understood way.
TikTok now has an opportunity to make representations to the ICO before a final decision is made.
In the UK 13 is the age of digital competence. Below that age children may not have social media accounts or enter into other consent-based data processing without either parental consent or an assessment of the child’s competence to make decisions about the use of their data that are in their best interests.
Sign Up Here:
This proposed enforcement action is particularly interesting because it also covers the alleged failure to provide effective privacy information. It is a legal requirement to provide privacy information at the point data are collected, in the form of a comprehensive and succinct privacy statement. We have found that organisations frequently get privacy statements wrong and have published our own guidance here. Gain the practical skills you need to identify and manage data protection and GDPR with this five-star rated training course. Available in person, online or in-house the focus on practical skills and unique post-course support you get by learning with us will ensure you and your organisation can tackle this key governance activity with confidence.Privacy Information
