Irish Data Protection Commission Announces The Decision of Sanctions Against TikTok

Kişisel Verilerin Korunması Hukuku

The Data Protection Commission (“DPC”) adopted its final decision regarding the inquiry into TikTok Technology Limited (“TikTok”) on 1 September 2023.

This inquiry examined the TikTok on complying with its obligations under the GDPR, during the period between 31 July 2020 and 31 December 2020, in relation to its processing of personal data relating to child users in the context of:

  1. Certain TikTok platform settings, including public-by-default settings as well as the settings associated with the ‘Family Pairing’ feature
  2. Age verification as part of the registration process.

At the conclusion of the investigation, the DPC submitted a draft on 13 September 2022. The DPC’s draft decision proposed findings of infringement of certain articles of GDPR. While there was broad consensus on the DPC’s proposed findings, objections to the draft decision were raised by the Supervisory Authorities (“SA”) of Italy and Berlin.

The European Data Protection Board adopted its binding decision on the subject matter of the objections on 2 August 2023. The decision oblies that the DPC must amend its draft decision to include the objection raised by the Berlin SA, and to extend the scope of the existing order to bring processing into compliance.

The DPC’s decision, which was adopted on 1 September 2023, records findings of infringement of certain articles of GDPR. The decision further consist following sanctions:

  • A reprimand;
  • An order requiring TikTok to bring its processing into compliance by taking the action specified within a period of three months from the date on which the DPC’s decision is notified to TTL; and
  • Administrative fines totalling €345 million.

You can find further information here and the full text of the final decision here.

Kind regards,

Zumbul Attorneys-at-Law