There’s no doubt that the video-sharing app TikTok has enjoyed spectacular growth during the pandemic. The app now claims to have over 800 million users worldwide and its parent company, ByteDance, has been valued at as much as US$400 billion ahead of a potential public offering.
But one possible cloud on the horizon is a billion-pound claim made in the UK courts for alleged breaches of data protection legislation in respect of personal data of children.
What is the claim all about?
The claim alleges multiple breaches of data protection law by TikTok in its collection and use of personal data about children. These include a lack of transparency, a failure to obtain parental consent when required and a failure to have a valid lawful basis for its processing of personal data.
The lead claimant in the case is an anonymous 12 year old girl from London. But what makes this case potentially very significant is that it is being brought as a representative action on behalf of all children under 16 across the EU (or under 13 in the UK) who have used the TikTok app since 25 May 2018. That date is important because it was when the EU’s General Data Protection Regulation (GDPR) came into force. The GDPR strengthened data protection laws across the EU and contained specific rules around children’s data.
How serious is the threat to TikTok?
The claim is certainly serious, not only because of the potential high cost of paying damages to such a large group of individuals should TikTok lose the case, but also because an adverse decision could threaten TikTok’s current highly successful business model.
If it loses the case, the courts could order TikTok to make changes to how it collects and uses data relating to children. Given the app’s popularity with children and young people, any decision that makes it more difficult for TikTok to sign up and retain such users could affect its income streams. And of course there would be reputational damage to TikTok’s brand if the courts were to find that the app had breached data protection laws.
What are the claim’s prospects of success?
The claim is still at a very early stage. Much will depend on the outcome of another case, Lloyd v Google, which is currently being heard in the Supreme Court. Representative actions are relatively uncommon in the UK and at issue in Lloyd v Google is whether such cases can be brought on behalf of a wide class of individuals in respect of data protection breaches.
The Supreme Court will decide whether Mr Lloyd’s claim can proceed on behalf of the entire class of individuals affected, without requiring them to specifically opt-in. If the Court rules against Mr Lloyd, this is likely to significantly harm the chances of the TikTok case proceeding. The TikTok claim is being funded by a third party litigation funder, and may not be viable unless it can encompass the entire class.
If the claimants can overcome this initial hurdle, then they will need to demonstrate that TikTok has breached data protection law to such a degree that compensation is payable to all individuals within the class.
Could this be the start of more data protection class actions?
Possibly. When GDPR came into force in 2018 there was much speculation about whether it would herald a new era of data protection class actions. That hasn’t yet happened, although there are ongoing cases arising from high profile data breaches by British Airways, Marriot and Easyjet. If the cases against Google and TikTok are successful, such cases will become easier to bring and so are likely to increase.
What else should TikTok be concerned about?
A new code of practice for digital services accessible by children came into force in September 2020. The code, produced by the Information Commissioner’s Office under the Data Protection Act 2018 contains mandatory standards of age appropriate design. It applies to services provided online and likely to be accessed by children, including apps, social media platforms and websites.
We are currently midway through a one-year grace period during which businesses are expected to bring their services into line with the code’s standards, before enforcement can begin in September 2021. Although the new code does not introduce any new legal requirements, businesses that provide online services will need to meet the standards contained within the code in order to comply with data protection laws. Apps popular with children such as TikTok will be very much in the spotlight.
