Introduction
The Data Protection Commission
("DPC") recently imposed a reprimand and
fine of €345m against TikTok, for GDPR violations in respect
of its processing of children's data, and ordered TikTok to
bring its processing operations into compliance by taking certain
specified actions within three months from the date of the
DPC's decision.
The fine was imposed following the conclusion of the DPC's
own-volition inquiry into TikTok's processing of data of child
users aged between 13 and 17 years old ("Child
Users"). The DPC concluded that TikTok did not
adequately protect the personal data of Child Users during the 5
month period between 31 July 2020 and 31 December 2020 (the
"Relevant Period"), in line with its
obligations under the GDPR. In particular, the DPC found that
TikTok:
