TikTok fined for violating children’s privacy Summary Our remarks TikTok is an app that allows users to create, edit and Transparent information share short videos online. By the end of 2019, the app • When a controller is communicating with data was used by 830,000 Dutch children between the ages subjects who speak a different language, they of 12 and 18. must, where possible, provide a translation of the From 25 May 2018 to 28 July 2020 inclusive, the privacy information in a language that the data subjects policy of TikTok was only available in English. understand. This is especially the case when the data subjects are children. In this case, TikTok believed that the Dutch DPA did not • It cannot be an argument for not translating e.g., have the authority to impose a fine on TikTok as they a privacy policy, that the data subjects from a had their main establishment in Ireland. The DPA found specific nation, in general, have a good command that TikTok had a main establishment in Ireland from 29 of English. July 2020 and the Dutch DPA had competence until that • A data controller should be aware of who their date. data subjects are. When a large amount of users The decision of the Dutch DPA of a service are children, the wording should be adapted to children when communicating with The Dutch DPA imposed a fine of 750,000 EUR on TikTok them e.g., when writing the privacy policy. for only providing their privacy policy in English to Dutch children (GDPR, Article 12(1)). Competence of a DPA • Where a data controller has established their primary operations across multiple EU countries, the lead supervisory authority holds the principal responsibility for taking action towards this data controller. The lead supervisory authority is identified as the governing body situated in the state where the data controller’s primary operations are located. • If a company does not have a primary establishment in Europe, any EU member state is empowered to supervise its activities. In this case, the Dutch Data Protection Authority would be authorized to take action against any violations until such time as TikTok established its primary operations in Ireland. Published: 09-04-2021 Journal number: N/A Tags: 02 Right of access and obligation to provide information 20