TikTok Inc v ICO: a preliminary issue decision on personal data processing for artistic purposes

On 31 July, the Upper Tribunal dismissed TikTok’s argument that its processing of personal data was carried out for artistic purposes and provided guidance regarding the interpretation of “for special purposes” in s 156 of the Data Protection Act 2018 (DPA 2018).

The ICO’s fine and TikTok’s appeal

On 4 April 2023, the Information Commissioner’s Office (ICO) fined TikTok £12.7 million for breaches of data protection law relating to the processing of underage children’s personal data.

TikTok appealed to the First-tier Tribunal on several grounds. It argued that at least some of its platform delivery processing was done for artistic purposes, and that the ICO was prohibited from issuing a penalty notice because s 156 of the DPA 2018 applied. Section 156 of the DPA 2018 requires the ICO to fulfil certain preconditions (namely obtaining court approval) before it can issue a penalty notice “with respect to the processing of personal data for the special purposes”, defined in s 174 as journalistic, academic, artistic, or literary purposes. TikTok claimed its data processing was sufficiently “proximate” to users’ artistic expression that it fell within s 156, and that the ICO had acted ultra vires in issuing the MPN without fulfilling the preconditions.

The First-tier Tribunal determined this challenge should be heard as a preliminary issue, but ultimately dismissed it in June 2025. The Upper Tribunal upheld this decision. In doing so, it provided helpful guidance on how s 156 of the DPA 2018 should be interpreted, and interesting commentary on the nature of TikTok’s data processing:

  • The Upper Tribunal held that the ordinary meaning of “for the special purposes” applied, and that “for” connotes deliberate intention. It dismissed TikTok’s argument that its processing of personal data to facilitate users’ free expression was sufficiently “proximate” to the special purposes (and that there was sufficient directness of purpose) that its processing could be considered “for” the special purposes defined in s 174.
  • The Upper Tribunal dismissed TikTok’s argument that TikTok’s recommender system effectively promoted artistic content because it advantages content made using TikTok’s creation and editing tools, noting that the creation and editing tools can also be used to make non-creative content and the recommender system cannot distinguish between creative and non-creative content. The Upper Tribunal held that “even when the system shares a video that is artistic or has artistic features it cannot do so for an artistic purpose because it is unaware of, and indifferent to, the artistic character of what it is sharing. TikTok is not therefore processing “for special purposes” (even as a subsidiary purpose), even if much of the content hosted on the app is itself artistic.”

Key takeaway

Companies should not assume that s 156 DPA 2018 applies where they process journalistic, academic, artistic, or literary content. In order for s 156 DPA 2018 to apply, the processing of the personal data in question needs to have been conducted directly “for” journalistic, academic, artistic, or literary purposes. If an algorithm is blind to whether content is artistic, it cannot be processing personal data for artistic purposes, even if much of the content being processed is artistic.

If you would like more information, please reach out to one of our lawyers, or if you would like to keep up to date on the latest in data protection, please subscribe to our quarterly newsletter, The Data Download.

NEW UK DATA PROTECTION COMPLAINTS PROCEDURE: WHAT YOU NEED TO KNOW BEFORE 19 JUNE

The UK’s new Data (Use and Access) Act 2025 will be changing the UK data protection laws to obligate all data controllers to implement a data protection complaints procedure by 19 June 2026.

What is the purpose of this new complaints procedure?

The new procedure allows individuals to raise data protection concerns directly with the organisation, prior to the individual complaining to the UK’s data protection regulator, the Information Commission. It is designed to ensure organisations handle complaints transparently, efficiently, and fairly while reducing the burden on the Information Commission.

What obligations do organisations have under this new procedure?

  • Provide assistance to individuals making complaints, such as offering an electronic complaints form or dedicated complaints email address.
  • Acknowledge complaints within 30 days.
  • Take appropriate interim steps, such as investigating the subject matter of the complaint and keeping the complainant updated on progress.
  • Inform the complainant of the outcome of their complaint without undue delay.
  • Issue a final response to the complaint.

The Information Commission has produced guidance and the new rules and details can be found here.

What can you do now to prepare?

  • Prepare and implement a complaints procedure for data protection concerns.
  • Update your privacy policy to inform people of the complaints procedure and how to raise complaints.
  • Train staff on how to respond to queries and complaints from people about data protection.

If you would like to receive similar updates, please sign up to our data protection newsletter here.

Technology Briefing – May 2026

Welcome to the spring edition of our technology briefing, designed to keep you updated on the latest legal and regulatory developments in the technology sector.

In this edition, we unpack the EU AI Act’s transparency obligations, highlighting recent developments and timelines for compliance. Additionally, we explore how businesses can challenge procurement decisions in government IT contracts and review the CMA’s updated guidance on unfair contract terms marking 10 years since the Consumer Rights Act 2015 was introduced. We also address the latest updates in data protection law. Finally, we cover the UK Government’s recently published Report on Copyright and Artificial Intelligence, which follows its consultation.

Recent Harbottle highlights include advising on the sale of After Party Studios to SISTER Group and launching our Indie Games Collective to mentor early-stage games businesses. We also published a thought leadership piece on AI-enabled cyber threats and, at C5’s AI & crypto fraud conference, Lizzie Williams shared insights on resolving smart contract disputes.

IN THIS EDITION


EU AI Act transparency obligations: latest developments and key obligations

A core requirement imposed by the EU AI Act (the Act) is in respect of transparency obligations for the AI systems used. The majority of the Act is expected to come into force on 2 August 2026. The European Parliament, however, has agreed a proposal that would delay the obligations imposed in respect of high risk AI systems. 

Read more >


Government IT contracts: how to challenge the procurement process

If your business enters into contracts with public sector entities for the provision of IT or related services, you will be familiar with the public sector tender and procurement processes. But are you familiar with what can be done to challenge the outcome of those processes? 

Read more >


Unfair contract terms in consumer contracts: new draft guidance from the CMA

If you deal with consumers, then you need to know how consumer law applies to your contract terms and notices. Ten years on from the introduction of the Consumer Rights Act 2015, the Competition and Markets Authority is revising its current guidance on unfair contract terms. 

Read more >


UK Government holds off on immediate AI Copyright reform

The Government has published its much-anticipated Report on Copyright and Artificial Intelligence, which follows a consultation that ran from 17 December 2024 to 25 February 2025. 

Read more >


Data protection update

This update includes key developments such as the ICO-HMG memorandum on data protection, new provisions under the Data (Use and Access) Act, guidance on international data transfers and age assurance, and significant enforcement actions like fines for unsolicited marketing, misuse of biometric data, and breaches involving children’s data, alongside global concerns over AI and high-profile investigations. 

Read more >


HARBOTTLE HIGHLIGHTS

Deal announcement: sale of After Party Studios

We have recently advised the shareholders of After Party Studios, a digital-first creative production company, on the sale of a majority stake to SISTER Group. 

Read more >


Harbottle & Lewis Indie Games Collective (IGC)

We recently launched our IGC, a mentorship programme which offers legal guidance to early-stage games businesses, to help them navigate in their next steps in the industry.

Read more >


AI-enabled cybercrime

Our new thought leadership piece, developed with Sodali & Co and LevelBlue, builds on insights from our recent event. It highlights key AI-enabled cyber threats, offers practical talking points, and provides actionable recommendations to support informed discussions with risk, legal, and cyber security teams. 

Read here >


AI & crypto fraud and asset recovery conference

Lizzie Williams recently spoke at this annual conference hosted by C5 Communications. She joined a panel to discuss smart contract disputes: what they are, how to avoid them and how to resolve them. The session proved valuable for those interested in coded contracts.


Please contact our technology experts if you would like to discuss anything in this briefing.

The UK’s Data (Use and Access) Bill passes as Lords’ concede on a push for AI transparency to protect creative industries

On 11 June, the House of Lords debated amendments to the Data (Use and Access) Bill (the Bill) and marked the culmination of an extensive “ping-pong” process between the House of Lords and the House of Commons regarding the protections for copyright holders in the context of artificial intelligence (AI).

What was the debate about?

  • The Government’s commitment to protecting copyright holders remains but it argues it cannot act prematurely without completing consultations on the issue. Emphasising the importance of transparency, enforcement and remuneration, it insisted on following due process, which includes analysing over 11,500 consultation responses and establishing technical and parliamentary working groups.
  • Several Lords, including Baroness Kidron and Lord Berkeley of Knighton, expressed frustration at the Government’s inaction. They argued that immediate transparency measures are needed to protect copyright holders from exploitation by AI companies. The creative sector fears that AI systems are using copyrighted works without consent or compensation, which could undermine the livelihoods of artists, writers, musicians and others.

What happened?

In efforts to ensure transparency and incentivise AI developers to comply with copyright law Lord Berkeley of Knighton introduced a new amendment to the Bill requiring AI developers to disclose which copyrighted works they use for training and how they access them, unless a licence has been agreed with rights holders.

Lord Berkeley ultimately withdrew his amendment, citing a desire to maintain the dignity of the House and avoid further unnecessary divisions. However, he and others urged the Government to take the concerns of the creative industries seriously and act swiftly to address them.

What will happen next?

The Bill now awaits Royal Assent and once in force, it will reform elements of the UK GDPR and Privacy Electronic Communications Regulations – from introducing a list of recognised legitimate interests to adding new exceptions to the consent requirements for cookies and similar technologies.

It should be noted that while the UK’s adequacy decision from the EU to allow a free flow of personal data transfers has been extended to 27 December 2025, the Bill does introduce changes to the UK GDPR which ultimately leads to a departure from the EU GDPR. As such, we wait eagerly to see if it decided whether or not the UK’s data protection regime will continue to offer materially equivalent protections in order to maintain the free flow of transfers between the UK and EU.

If you would like more information, please feel free to reach out to one of our dedicated data protection lawyers, or if you would like keep up to date on the latest in data protection, please subscribe to our quarterly newsletter, The Data Download.