Inquiry into TikTok Technology Limited - September 2023 (PDF, 5.9mb)
| Section | Decisions made under data protection act 2018 |
In the
matter
of the
General Data Protection Regulation
DPC
Inquiry Reference: IN-21-9-1
In the
matter
of
TikTok Technology Limited
Decision
of the
Data Protection Commission made pursuant
to
Section
111 of the
Data
Protection
Act, 2018 and
Articles
60 and 65 of the
General Data Protection Regulation
Further
to an
own-volition inquiry commenced pursuant
to
Section
110 of the
Data Protection
Act, 2018
DECISION
Decision-Maker
for the
Commission:
[sent electronically, without signature]
Helen Dixon
Commissioner
for
Data Protection
Dated
the 1st day of
September, 2023
cPc
An
Coimisiun
um
Chosaint Sonrai
Data Protection
Commission
Data Protection Commission
21
Fitzwilliam Square South
Dublin
2,
Ireland
A.
INTRODUCTION
The
General Data Protection Regulation ("GDPR")
is a
regulation
in
European Union
law on the
protection
of
individuals with regard
to the
processing
of
their personal data.
The
date
of
application
of the
GDPR
is 25 May
2018.1
The
Data Protection Commission ("DPC"
or,
otherwise,
"IE SA") was
established
on 25 May
2018,
pursuant
to the
Data Protection
Act 2018 ("the 2018
Act"),
as
Ireland's supervisory
authority within
the
meaning
of, and for the
purposes specified
in, the
GDPR.2
This
is a
decision
("the
Decision")
of the DPC
pursuant
to
Section
111 of the 2018 Act and
Articles
60 and 65 of the
GDPR.
I
have made this Decision,
as the
decision-maker
for the DPC,
further
to an
own-volition Inquiry conducted
by the DPC
pursuant
to
Section
110 of the 2018
Act ("the
Inquiry"), concerning
the
compliance
or
otherwise
of
TikTok Technology Limited with
its
obligations pursuant
to
Articles
5, 12, 13, 24 and 25
GDPR
in the
context
of the
TikTok
platform.
For the
purpose
of
this Decision,
"TTL"
will
be
used
to
refer
to
TikTok Technology
Limited while "TikTok" will
be
used
to
refer
to the
platform itself, whether
web- or
application-
based.
In
preparing this Decision,
the DPC has
taken into account
all
submissions made
by TTL in
response
to the
Inquiry,
as
well
as
other relevant information received
by the DPC, and
public
sources
of
information,
as set out in
this Decision.
4.
This Decision further reflects
the
binding decision that
was
adopted
by the
European Data
Protection Board
("the
EDPB") pursuant
to
Article
65(2) of the
GDPR,3
("the
Article
65
Decision") which directed changes
to
certain aspects
of the
positions reflected
in the
draft
decision that
was
presented
by the DPC for the
purposes
of
Article
60
GDPR
("the
Draft
Decision"),
as
detailed further, below.
The
Article
65
Decision will
be
published
on the
website
of the
EDPB,
in
accordance with Article
65(5)
GDPR,
and a
copy
of
same
is
attached
at
Appendix
1 to
this Decision.
It is
important
to
note that this Decision, including
the
analysis
and
findings herein,
is
without
prejudice
to any
other investigation and/or inquiry that
may be
conducted
in
relation
to the
assessment
of the
legal basis/legal bases relied upon
for
processing
of the
personal data
of
registered
EU
TikTok users under
the age of 18
("Child Users")
by TTL in the
context
of the
TikTok platform.
6.
B.
SUMMARY
OF
FACTUAL BACKGROUND
TikTok
is a
video-focused social media platform that allows registered users
to
create
and
share
videos
of
varying durations
and to
communicate with other users through messages.
TTL
states
that TikTok
is not a
"social network"
and is,
rather,
a "a
global entertainment platform that,
at
its
core,
was
designed
to
enable Users
to
create
and
share video content, enjoy videos from
a
1
Regulation
(EU)
2016/679
of the
European Parliament
and of the
Council
of 27
April
2016 on the
protection
of
natural persons with regard
to the
processing
of
personal data
and on the
free movement
of
such data,
and
repealing Directive 95/46/EC (General Data Protection Regulation).
2 SI
175/2018 Data Protection
Act 2018
(Establishment
Day)
Order
2018.
3
Binding Decision 2/2023
on the
dispute submitted
by the
Irish
SA
regarding TikTok Technology Limited
(Art.
65
GDPR) (adopted
2
August 2023).
2
variety
of
creators,
and
otherwise express their creativity, such
as by
interacting with videos
to
express
new
perspectives
and
ideas."4
Per
TTL's Director's Report
and
Financial Statement
for the
year ending
31
December 2020,
TTL
is a
private company limited
by
shares, incorporated
on 12
October 2018.5 TTL's sole
shareholder
is
TikTok Information Technologies
UK
Limited. TTL's ultimate parent
is
ByteDance
8.
Ltd.6
TikTok launched
on the
worldwide market
in
September
2017.
With effect from
29
July 2020,
the
data controller
for
EU/EEA users transferred from TikTok
Inc. to
TikTok Information
Technologies
UK Ltd. and TTL as
joint controllers.7
9.
The
TikTok platform
is
accessible
via a
standalone mobile phone application
and can
also
be
viewed
as a
webpage from
a web
browser. Persons
who
have
not
registered
as a
TikTok user
can
view certain content
on the
webpage version
of the
TikTok user's profile page, which
is
also
presented
in the 'For You'
TikTok homepage. Access
to the
mobile phone application
is
restricted
to
registered users.
10.
During
the
period
of 29
July 2020
to 31
December 2020,
TTL
processed personal data
in the
context
of the
activities
of a
single establishment
of a
controller
or
processor
in the
European
Union
but
which substantially affects
or is
likely
to
substantially affect data subjects
in
more
than
one
Member State.8 TTL's single establishment
in
Ireland
is
supported
by
affiliated entities
in the
European Union
in
Germany, France, Poland, Italy, Spain
and
Sweden.9
11.
The
TikTok service
is
provided
on the
basis
of a
written contract between
TTL and the
user,
referred
to as its
'Terms
of
Service'.10
The
relevant version
of the
Terms
of
Service,
for the
purpose
of
this Decision,
is
that
of
July 2020.11
12.
The
collection
and use of
TikTok users' personal information
is
described
in the
TikTok Privacy
Policy.12
The
relevant version
of the
Privacy Policy,
for the
purpose
of
this Decision,
is
that
of
July 2020.13 TikTok also
has a
'TikTok Summary
for
Users U18'.14
13.
Per
TikTok's Terms
of
Service, users
of the
platform must
be at
least
13
years
of
age.15 TikTok
has a
content rating
on the
Apple
App
store
of '12+' and on the
Google Play store
of
'Parental
Guidance Recommended'.16
In
order
to
register
as a
user
of
TikTok,
a
potential user
can do so
14.
4
Response
to the PDD at
[3.1]-[3.2].
5
This same information appears
in
TTL's Director's Report
and
Financial Statement
for the
year ending
31
December
2021.
6
TikTok Technology Limited, 'Director's Report
and
Financial Statement' (Year Ending
31
December 2020). This
same information appears
in
TTL's Director's Report
and
Financial Statement
for the
year ending
31
December
2021.
7
Notice
of
Commencement
at [5] and
Response
to the
Notice
of
Commencement
at
[6.1].
8
Response
to the
Notice
of
Commencement
at
[7.1].
9
Response
to the
Notice
of
Commencement
at
[8.2].
10 TTL
TikTok Terms
of
Service.
11 See
Response
to the
Notice
of
Commencement
at
[4.1.1.].
12 TTL
TikTok Privacy Policy.
13 See
Response
to the
Notice
of
Commencement
at
[4.1.3].
14 TTL
TikTok Summary
for
Users
U18.
15
Response
to the
Notice
of
Commencement
at [1.5] and
TikTok, 'Terms
of
Service' (July 2020)
at [2].
16
Response
to the
Notice
of
Commencement
at
[1.5].
3
To continue reading
Request your trial