On 31 July, the Upper Tribunal dismissed TikTok’s argument that its processing of personal data was carried out for artistic purposes and provided guidance regarding the interpretation of “for special purposes” in s 156 of the Data Protection Act 2018 (DPA 2018).

The ICO’s fine and TikTok’s appeal

On 4 April 2023, the Information Commissioner’s Office (ICO) fined TikTok £12.7 million for breaches of data protection law relating to the processing of underage children’s personal data.

TikTok appealed to the First-tier Tribunal on several grounds. It argued that at least some of its platform delivery processing was done for artistic purposes, and that the ICO was prohibited from issuing a penalty notice because s 156 of the DPA 2018 applied. Section 156 of the DPA 2018 requires the ICO to fulfil certain preconditions (namely obtaining court approval) before it can issue a penalty notice “with respect to the processing of personal data for the special purposes”, defined in s 174 as journalistic, academic, artistic, or literary purposes. TikTok claimed its data processing was sufficiently “proximate” to users’ artistic expression that it fell within s 156, and that the ICO had acted ultra vires in issuing the MPN without fulfilling the preconditions.

The First-tier Tribunal determined this challenge should be heard as a preliminary issue, but ultimately dismissed it in June 2025. The Upper Tribunal upheld this decision. In doing so, it provided helpful guidance on how s 156 of the DPA 2018 should be interpreted, and interesting commentary on the nature of TikTok’s data processing:

• The Upper Tribunal held that the ordinary meaning of “for the special purposes” applied, and that “for” connotes deliberate intention. It dismissed TikTok’s argument that its processing of personal data to facilitate users’ free expression was sufficiently “proximate” to the special purposes (and that there was sufficient directness of purpose) that its processing could be considered “for” the special purposes defined in s 174.
• The Upper Tribunal dismissed TikTok’s argument that TikTok’s recommender system effectively promoted artistic content because it advantages content made using TikTok’s creation and editing tools, noting that the creation and editing tools can also be used to make non-creative content and the recommender system cannot distinguish between creative and non-creative content. The Upper Tribunal held that “even when the system shares a video that is artistic or has artistic features it cannot do so for an artistic purpose because it is unaware of, and indifferent to, the artistic character of what it is sharing. TikTok is not therefore processing “for special purposes” (even as a subsidiary purpose), even if much of the content hosted on the app is itself artistic.”

Key takeaway

Companies should not assume that s 156 DPA 2018 applies where they process journalistic, academic, artistic, or literary content. In order for s 156 DPA 2018 to apply, the processing of the personal data in question needs to have been conducted directly “for” journalistic, academic, artistic, or literary purposes. If an algorithm is blind to whether content is artistic, it cannot be processing personal data for artistic purposes, even if much of the content being processed is artistic.

If you would like more information, please reach out to one of our lawyers, or if you would like to keep up to date on the latest in data protection, please subscribe to our quarterly newsletter, The Data Download.

AUTHORS

Michael Yates Partner

Michael is an information litigator who specialises in advising individuals and companies on reputation management, cyber crisis management and information, data privacy and media law disputes.

Michael is an information litigator who specialises in advising individuals and companies on reputation management, cyber crisis management and information, data privacy and media law disputes.

He covers the full spectrum of contentious matters, including in-print and online defamation, malicious falsehood, misuse of privacy information, breach of confidence, data protection, cyber attacks, data breaches, information theft, harassment, blackmail, right to be forgotten and subject access requests. He also advises on regulatory media and data complaints, reporting restrictions, NDAs, injunction applications, Norwich Pharmacal applications, online takedowns, apologies, damages claims and coroners' proceedings.

Michael often urgently advises clients who are in a crisis, typically when trying to protect reputation by stopping or mitigating the publication or broadcast of a false story, project managing a response to a cyber attack or preventing the unlawful misuse or disclose of information. He also provides regular training and preparedness sessions to clients to help get ahead of a media or cyber crisis.

He also protects publishers, platforms, data controllers and processors from legal claims.

Michael is ranked as ‘Up and coming’ in Chambers and Partners and is ‘Recommended’ by Spears Magazine.

Nadia Ahmed Senior Associate

Nadia is a senior associate specialising in data protection, privacy and information law.

Nadia is a senior associate specialising in data protection, privacy and information law.

She advises on compliance with data protection laws and information laws, including the UK and EU General Data Protection Regulation (GDPR), the Data Protection Act 2018, the Freedom of Information Act (FOIA) and codes of practice issued by the ICO and other data protection regulators.

She assist clients with data protection agreements/addendums (DPA), data protection impact assessments (DPIA), drafting and reviewing privacy policies and cookies policies and cookie banners. Nadia handles contentious data protection matters too such as communications with the ICO, personal data breaches and data subject requests such as data subject access requests (DSAR). She keep clients informed of any changes to data protection laws and updated guidance from data protection regulators, and provides training to legal teams and employees on data protection best practices. Nadia has also been seconded to help ensure compliance with GDPR and information law procedures are effective and meet the necessary standards.

Nadia works with a wide range of clients, from small businesses to large corporations, to help them understand their legal obligations and develop data protection strategies and programmes for compliance with data protection laws. Such clients include those in the fashion and retail sector, streaming services, gaming, technology and more.

Nadia has completed the Certified Information Privacy Professionals/Europe (CIPP/E) by IAPP and is a member of the Society for Computers and Law.

Ella Ditri Associate

Ella is a dispute resolution lawyer who advises on a broad range of commercial disputes.

Ella is a dispute resolution lawyer who advises on a broad range of commercial disputes.

Ella advises clients at the pre-action phase and throughout all stages of the litigation process. As well as complex High Court litigation, she has experience resolving disputes through settlement negotiations.

Ella acts for clients across a broad range of sectors, including technology, media and entertainment and financial services. She has particular experience handling disputes involving breach of contract claims and contractual interpretation.

Ella read History at the University of Oxford and graduated with first class honours in 2019. She trained at Clifford Chance, where she qualified into their Litigation & Dispute Resolution team in 2024. Ella joined Harbottle & Lewis in 2026.

Ella is a member of the Next Generation Media Lawyers.