The Upper Tribunal (Lady Poole and Upper Tribunal Judges Wikeley and Church) has published its decision (given last month) in the appeal by TikTok against the First-tier Tribunal’s (“FtT”) decision in its appeal against the penalty notice served on it by the Information Commissioner. This appeal dealt only with a preliminary issue which had been separated from the rest of TikTok’s appeal by the FtT (this approach was criticised by the Upper Tribunal at [12] and [13] of the Upper Tribunal’s decision). The preliminary issue concerned whether the penalty notice was ultra vires because the processing in question was for the special purposes which required the Commissioner to undertake additional procedural steps which he had not done.

TikTok advanced five grounds of appeal before the Upper Tribunal which were as follows:

1. Did the FtT err by construing those parts of the [penalty notice] which penalised TikTok for breach of Articles 5(1)(a) and 8 of the UK GDPR as being given only with respect to the processing of the data of underage children?
2. Did the FtT err by holding that, as TikTok did not wish underage children to use its platform, its processing of their data in the delivery of the TikTok platform service to them could not be for the special purposes (or, indeed, any purpose at all)?
3. Did the FtT err in law in holding that the parts of the [penalty notice] penalising TikTok for breaches of Articles 12 and 13 were not given with respect to  the processing of personal data at all, but rather in relation to procedural obligations?
4. Did the FtT err by failing to read and give effect to s. 156 compatibly with the ECHR rights of TikTok and its users
5. Did the FtT err by concluding that the [penalty notice] could potentially be upheld insofar as it concerned processing for the purposes of delivering targeted advertising even if, contrary to the FtT’s conclusions, other parts of the [penalty notice] were given with respect to processing of personal data for the special purposes.

The Upper Tribunal grouped grounds two and four together and grounds one and three together. It decided not to address the fifth ground because of the conclusions that it had reached in relation to grounds one to four. [114]

Grounds 2 and 4

These grounds both concerned the proper interpretation of section 156 of the Data Protection Act 2018 (“the 2018 Act”). The Upper Tribunal explained the background to section 156 which is one of a number of provisions of the 2018 Act designed to implement Article 85 of the UK GDPR [31]. Derogations under Article 85 are restricted to ‘situations in which they are “necessary” to reconcile protection of personal data with freedom of expression and information.’ [32] Section 156 of the 2018 Act does not apply only where the processing is solely for the special purposes; where there are multiple purposes for the processing, section 156 will apply where at least one of them is for one or more of the special purposes. [40]

Ground 2

TikTok argued that its platform delivery processing was undertaken for the special purposes, particularly artistic purposes. It did not argue that all platform delivery services were covered by section 156, nor did it seek to argue that all of its processing was covered by section 156. It relied upon BBC v Sugar (No 2) (which concerned the BBC’s derogation under the Freedom of Information Act 2000). However, the Upper Tribunal did not find the test articulated by Lord Walker in Sugar (No 2) to be of assistance in understanding section 156. [43] The Upper Tribunal stated, at [43]:

“While BBC v Sugar (No 2) concerned the free expression concept of journalism, it was decided under a materially different statutory scheme (the Freedom of Information Act 2000) and it was expressed in materially different language.”

TikTok also submitted it was important to have regard to the “directness of purpose” and that there was sufficient directness of purpose in respect of its platform delivery processing. This was on the basis that the processing was fundamental to users being able to access its services in order to create or appreciate the artistic content which TikTok was designed to enable dissemination of. However, the Upper Tribunal did not find this test of assistance either. [43] What had to be applied was the words used by Parliament in section 156 of the 2018 Act. [43]

The Upper Tribunal considered that “for” connoted an intention that was deliberate. [44] In essence, whether TikTok’s processing was carried out for artistic purposes was dependent on the meaning of artistic purposes and whether the processing with which the penalty notice was concerned was done in furtherance of those purposes. [45]

TikTok’s mission statement or broader aspirations are not relevant for determining whether section 156 of the 2018 Act applies; what matters is the processing itself. [53] It is not sufficient for processing to facilitate, or be associated with, the dissemination of material which has special purposes characteristics; for processing to be for the special purposes it itself must be journalistic, academic, artistic or literary. [53] The Upper Tribunal continued, at [54]:

“TikTok’s system cannot identify whether content is artistic or not. It does not (and cannot) use the presence or absence of artistic characteristics as a criterion for distributing content. It distributes content to users instead according to the algorithm’s prediction of whether and to what extent a particular user will engage with that content, irrespective of its artistic or non-artistic nature. This is dispositive of TikTok’s case on section 156 DPA 2018, not only in relation to the processing of the data of underage children but also in relation to its “platform delivery processing” to all users.”

The Upper Tribunal held that “TikTok is not therefore processing “for the special purposes” (even as a subsidiary purpose), even if much of the content hosted on the app is itself artistic.” [55] In relation to underage children, the Upper Tribunal stated “it is clear that none of the purposes for which TikTok processed data during the relevant period can have involved enabling the free expression of underage children through use of the platform.” [56] This was based on the evidence adduced by TikTok before the FtT.

Ground 4

The Upper Tribunal dealt with this ground relatively briefly. The Upper Tribunal had regard to the cautionary words of Lord Reed in Osborn v The Parole Board where he cautioned against treating human rights protection as a distinct area of the law because human rights law permeates the domestic legal system. [61] Section 156 of the 2018 Act is the domestic law which is seeking to give effect to the relevant convention rights. [62] It is not inconsistent to interpret free expression concepts broadly while giving the words of section 156 of the 2018 a narrow construction in accordance with the words of Article 85. [61] It is often the case that multiple convention rights are in play in relation to legislative provisions and often those different rights pull in different directions. [62] Unless doing so results in inadequate protection for convention rights, it is necessary to give the words chosen by Parliament (in their relevant context) their ordinary meaning. [63]

TikTok argued before the Upper Tribunal that some users who were of the required age to access its services might chose not to verify their age (should TikTok move to an age verification rather than age warranting system, as the penalty notice appears to require it to do) and therefore would lose their Article 10 rights. The Upper Tribunal was not impressed with this argument and gave it short shrift holding that the argument ignored “the fact that Article 10 rights are not absolute.” [64] Should the regulatory action taken by the Commissioner result in a move to age verification, that was not something that was automatically in contravention of Article 10 rights. [64]

The Upper Tribunal considered that the FtT’s conclusion that Article 10 would not have altered its decision on the preliminary issue was unreasoned [66]; however, the Upper Tribunal concluded that the FtT had not erred in law and dismissed the fourth ground of appeal. [66]

Grounds 1 and 3

Because of the conclusions that the Upper Tribunal had reached in relation to grounds 2 and 4, it was not necessary for it to determine grounds 1 and 3; however, it did so (briefly) because they had been fully argued before the Upper Tribunal. [68]

The Upper Tribunal agreed with the submission of senior counsel for TikTok that “the Upper Tribunal must construe the [penalty notice] for itself.” [80] The proper construction of the notice is an “objective legal question that must be determined in accordance with the usual legal principles of interpretation.” [80] The Upper Tribunal was unpersuaded by the submissions that considering the particular context of the words contained in the penalty notice extended to considering statements made by the Commissioner outwith the notice of intent and the penalty notice itself. [82]

Ground 1

The Upper Tribunal determined that simply because the personal data of all of its users was subjected to the same processing it did not logically follow that the penalty notice had to apply to the entirety of such processing. [83] The Upper Tribunal continued, at [83]:

“The same processing may be objectionable in respect of one category of data subjects and therefore deserving of sanction, and yet unobjectionable or less objectionable in respect of others, and therefore not deserving of sanction.”

The Upper Tribunal also highlighted that the Commissioner is not required by the statutory scheme to punish every breach in respect of every data subject. [83] The Upper Tribunal was not of the view that the processing of personal data in relation to underage children was inseparable from processing by TikTok of personal data of users who had attained the age of 13. [83]

TikTok had argued that as the consequences of the penalty notice served by the Commissioner might affect those who were legitimately using the platform (i.e. those who were at least 13 years old) it had to be read as having been given with respect to the processing of those users as well. The Upper Tribunal was not persuaded this. [84]-[85]

In relation to Article 8 of the UK GDPR, the Upper Tribunal held that “to the extent that the [penalty notice] was given with respect to breach of Article 8 UK GDPR, it was given with respect to the processing of the personal data of underage children only, and not with respect to the processing of the personal data of other users.” [88]

In relation to Article 5(1)(a) the Upper Tribunal stated, at [94]:

“While it is possible to read paragraphs 157 and 158 of the [penalty notice] as applying to TikTok’s processing of the data of all its UK users (but with a special emphasis on its processing of children’s data), the Upper Tribunal prefers a narrower interpretation: in this passage the [penalty notice] first identifies the general category of breach (the unlawful processing of personal data), and then particularises it (the unlawful processing of the personal data of children). It then particularises the breaches further, identifying the specific failings penalised by the [penalty notice] (…)”

The Upper Tribunal continued at [98]:

“(…) when the [penalty notice] is read as a whole, it is adequately clear that the processing with which the Commissioner was concerned was the processing of the personal data of underage children only, and not the processing of the data of users who had reached their thirteenth birthday.”

To the extent that the FtT may have relied upon evidence as to what the Commissioner stated the intention was in respect of the penalty notice and what it covered rather than its own analysis of the words of the penalty notice then that was the wrong approach. However, because the FtT would have been bound to come to the same conclusion by taking the correct approach that would not have amounted to a material error of law on the part of the FtT. [101]

Ground 3

Articles 12 and 13 of the UK GDPR are not simply specific rules implementing a more general obligation in Article 5(1)(a) to be transparent; they are provisions which compliment the obligation in Article 5(1)(a). [105] While a breach of Articles 12 and/or 13 might flow into a breach of Article 5(1)(a) when relevant processing occurs, it does not follow that a breach of either Articles 12 or 13 is a processing breach or that a penalty notice served on a controller in relation to a breach of Articles 12 or 13 is made with respect to processing. [106]. Where a penalty notice is issued in respect of a processing breach which concerns a lack of transparency, such notice is served with respect to Article 5(1)(a) rather than Articles 12 or 13. [106]

The power given to the Commissioner to serve a penalty notice is not restricted only to breaches where processing has occurred. [108] The Upper Tribunal ultimately held that the FtT did not fall into error when it determined that the penalty notice for breach of Articles 12 and 13 was not given in respect to the processing of personal data. [111]

Comment

The Upper Tribunal, in dismissing its appeal, was ultimately not persuaded by any of the substantive arguments advanced by TikTok under grounds one to four. It was also not impressed by the decision taken by the FtT to deal with the vires issue as a preliminary issue highlighting the length of time that this case had taken without the substantive issues being addressed. There could yet, with permission, be subsequent appeals in relation to the preliminary issue matter to the Court of Appeal and then the Supreme Court before the FtT even considers the substantive appeal against a penalty notice served in 2023.

The Upper Tribunal did, however, recognise the important points of law which this appeal raised and, as a consequence, sat as a bench of three judges (including the current president of the Administrative Appeals Chamber, Lady Poole). Unless there is any onward appeal by TikTok the matter will now go back to the FtT so that it can hear the substantive appeal against the penalty notice; the outcome of the preliminary issue of vires does not necessarily mean that the penalty notice will stand once the substantive part of the appeal is heard.

The Upper Tribunal’s decision gives important, clear and authoritative guidance on the scope and application of section 156 of the 2018 Act and recognises that the special purposes provisions within the 2018 Act are the means by which Parliament has sought to balance the competing rights in Articles 8 and 10 of the European Convention on Human Rights. The Upper Tribunal’s decision also somewhat acts as a reminder that although FOI and data protection often get lumped together, they are different statutory schemes and therefore care should be taken when seeking to import concepts from one into the other. It is necessary to have regard to the specific words used by Parliament in the statutory scheme under consideration as a starting point (and this will very often be the end point as well).

^{Disclaimer: This article is for information purposes only and nothing in it should be taken as constituting legal advice.}