The Upper Tribunal has issued its decision in TikTok Inc & Anor v The Information Commissioner [2026] UKUT 277 (AAC).
The Information Commissioner was concerned about TikTok’s processing of children’s personal data. Following an investigation, the Commissioner imposed a £12.7 million monetary penalty on TikTok for breaches of Articles 5(1)(a), 8, 12 and 13 of the UK GDPR.
TikTok appealed to the First-tier Tribunal, arguing that its processing of personal data had been “for the special purposes”, namely journalistic, academic, artistic or literary purposes, and that the Information Commissioner was not entitled to issue the monetary penalty notice without first satisfying the requriements in section 156 of the Data Protection Act 2018: issuing a determination under section 174(3) and obtaining leave from a court. The First-tier Tribunal directed a hearing on the preliminary issue of whether the monetary penalty notice was ultra vires, and decided that issue against TikTok.
TikTok appealed to the Upper Tribunal, which dismissed the appeal on the preliminary issue. It found that:
- the processing covered by the monetary penalty notice was not “for” the special purposes. To fall within section 156 of the Data Protection Act 2018, it is not sufficient that processing facilitates, or is associated with, the dissemination of material that itself has special purposes characteristics. Processing is “for the special purposes” only where the purpose of the relevant processing is itself journalistic, academic, artistic or literary. The preconditions in section 156(1) therefore did not apply, and the notice was not ultra vires;
- the interpretative obligation under section 3 of the Human Rights Act 1998 did not mean that the additional preconditions had to be satisfied before the monetary penalty notice could lawfully be issued;
- the parts of the monetary penalty notice concerning breaches of Articles 5(1)(a) and 8 of the UK GDPR were properly construed as relating only to the processing of underage children’s data;
- the parts of the monetary penalty notice concerning breaches of Articles 12 and 13 related to procedural obligations, rather than to the processing of personal data; and
- given those findings, it was unnecessary to determine a fifth ground of appeal about whether the monetary penalty notice could be partially upheld.
The case has been remitted to the First-tier Tribunal to consider the remaining outstanding issues.
The ICO said:
“We welcome the Upper Tribunal’s decision to dismiss TikTok’s appeal and remit the case to the First-tier Tribunal for determination of the substantive issues. The Upper Tribunal’s reasoning sets an important precedent for the application of the special purposes provisions in data protection law. While this case concerns TikTok, the Tribunal’s approach is likely to be relevant to other online platforms in similar circumstances. We will now continue to defend our original decision before the First-tier Tribunal. We remain committed to ensuring that organisations, particularly those providing online services to children, comply with their data protection obligations.”
