The article reports on the Irish Data Protection Commission (DPC) taking action against TikTok over its handling of children’s personal data. The DPC has found that TikTok failed to obtain parental consent for minors’ data processing, which is a requirement under the General Data Protection Regulation (GDPR). As a result, the DPC has fined TikTok €5.8 million and ordered the company to pay an additional €3.7 million in costs.
The investigation was sparked by concerns raised by other EU data protection authorities and consumer protection groups about TikTok’s handling of user data, particularly children’s information. The DPC had been probing TikTok’s handling of minors’ data for two years, with pressure from various stakeholders.
The decision is notable because it marks the first major enforcement action against a Big Tech company under the GDPR. The EDPB (European Data Protection Board) played a crucial role in this case by taking binding decisions on Ireland-led investigations into Big Tech companies.
TikTok has been criticized for its handling of children’s data, and this decision is seen as a significant step towards holding the company accountable. However, some critics argue that the fine is too lenient, given the severity of the breach.
The article also mentions another ongoing investigation by the DPC into TikTok’s data transfers to China, which is expected to result in further sanctions.
Key points:
- The Irish Data Protection Commission (DPC) has fined TikTok €5.8 million for failing to obtain parental consent for minors’ data processing.
- TikTok has been ordered to pay an additional €3.7 million in costs.
- The investigation was sparked by concerns raised by other EU data protection authorities and consumer protection groups about TikTok’s handling of user data, particularly children’s information.
- The EDPB played a crucial role in this case by taking binding decisions on Ireland-led investigations into Big Tech companies.
- This decision marks the first major enforcement action against a Big Tech company under the GDPR.