The UK High Court Tuesday allowed a representative suit against the video-sharing social media app TikTok alleging the unlawful processing of children’s data.
The (now former) Children’s Commissioner for England, Anne Longfield, brought forth this representative action on behalf of the claimant, a girl under the age of 16, and other children residing in the UK or the European Economic Area (EEA) who had accounts or used TikTok since May 25, 2018.
The claimant alleged violation of the EU’s General Data Protection Regulation (GDPR) and the UK’s Data Protection Act, 2018. She has impleaded several overseas defendants, including companies in the US and China, who are data controllers of TikTok. She has also impleaded ByteDance Limited, the parent company of Tiktok incorporated in the Cayman Islands. Only one of the defendants, TikTok Information Technologies Limited, is domiciled within the UK.
If the legal action is successful, TikTok may be liable to pay billions of dollars as compensation.
The court has noted that the claimant filed the suit with some urgency to ensure that the relevant law would not change due to the Brexit transition period ending. After the transition period, English courts will no longer have jurisdiction under the GDPR over children residing in the EEA. Further, the claimant could serve one of the defendants incorporated in the Republic of Ireland without the court’s permission.
The suit was stayed due to the UK Supreme Court’s pending decision in Lloyd v. Google, a similar representative privacy lawsuit brought against Google alleging violation of Section 13 of the Data Protection Act, 1998. The Supreme Court decided in favor of Google. The court found “no material damage or distress to the individual concerned,” as required by Section 13.
However, the claimant in this case argued that the dispute in Lloyd v. Google arose before the enforcement of the GDPR and that the present claim, based on the GDPR, was therefore materially different. The court, satisfied at this stage with the claimant’s distinction between the Lloyd case and the present suit, has allowed the suit to proceed. The UK-based TikTok entity has applied for a summary judgment where the court may dismiss the case in the coming months if it finds the defendant’s counterarguments acceptable.
There has been an increased focus on protecting children’s data in recent years. Since the filing of this suit, the UK has enforced the Children’s Code which sets standards for how the GDPR is applied in cases of children using social media platforms. The UK government has also introduced a draft Online Safety Bill which prescribes increased safeguards for children.
