Blog

2025 has quickly moved on for GDPRXpert data protection consultants and it is now well worth looking at the most recent Annual Report by the DPC. The report was issued in 2024 and covers activity for the year 2023. It will be interesting to see the year-on-year changes and any new trends when the 2024 report is issued. As soon as that report is made available we will dissect it in a future blog for comparative purposes and see if any discernible  trends can be identified.

We touched on the 2023 report  briefly in our last blog and noted,  “As the report states, 2023 was a busy year in personal data rights protection. The year saw a significant increase in complaints dealt with by the Data Protection Commission (“DPC”) with record fines issued and corrective orders imposed following cross-border and national inquiries. More generally, there were a large number of data protection-related judgments from the Court of Justice of the European Union and continued domestic focus before the Irish courts”. Perhaps not coincidentally, 2023 was also a busy year for GDPRXpert.ie and for many operating a data protection advisory service. In particular, there was a high demand for the outsourced data protection officer service provided by GDPRXpert.ie

There are very good reasons why this is so, but primarily it is because of the increasing amount of time and internal resources organisations must dedicate to data protection compliance.  Without any doubt, there is a scarcity within many organisations  of properly qualified staff to manage this  onerous responsibility. On top of this, it is too risky to overburden  a staff member with new data protection responsibilities when the person has already been delegated responsibility for other areas within which they are more at ease, more familiar and singularly competent. It is no surprise there is a growing number of organisations contacting data protection consultants such as GDPRXPERT.ie with a view to outsourcing the role of data protection officer for their organisation. Last year was a record year in this regard and there is no reason to believe this will change in the foreseeable future.

The DPC 2023 report did recognise the increasing demand for data protection officers and viewed it as part of an increasing awareness of the changed dynamics in data protection, especially since the GDPR was introduced. This is partly due to the DPC itself having allocated a mixture of resources with the objective of raising awareness of data protection obligations and educating organisations in regard to reaching data protection compliance.

It is natural that the DPC, whilst continuing its overall awareness building, has now moved to a stronger enforcement mode.

The DPC, nevertheless, emphasised that it continues its mission of safeguarding  the data protection rights of individuals and providing  clarity for the organisations it regulates by:

• educating stakeholders on their rights and responsibilities;
• taking a fair and balanced approach to complaint handling;
• communicating extensively and transparently with stakeholders;
• participating actively at European Data Protection Board level to achieve consistency; cultivating technological foresight, in anticipation of future regulatory developments;
• sanctioning proportionately and judiciously; and
• retaining and amalgamating the expert capacities of its staff to ensure operational effectiveness.

The DPC in the report referred to its overall strategy as had been set out in its Regulatory Strategy for 2022-2027. It is a strategy based around five interconnected pillars of equal priority:

1. Regulate consistently and effectively;
2. Safeguard individuals and promote data protection awareness;
3. Prioritise the protection of children and other vulnerable groups;
4. Bring clarity to stakeholders; and
5. Support organisations and drive compliance.

Perhaps ironically, organisations looking for support and striving to drive  compliance have been engaging the services of data protection consultants such as GDPRXPERT.ie and begun to use the outsourced  data protection officer service. The DPC has become aware of this trend and it is a welcome trend. As mentioned earlier, not all organisations are in a position to appoint a full time or part-time DPO in house.

Data Protection Officers (DPOs) are a key component in Ireland’s data protection compliance record. For DPOs to operate effectively they need the support of Senior Management and to have regular and direct communication lines into their organisation’s Management Board. A key part of the DPC’s strategic goal of supporting organisations and driving compliance is working with Data Protection Officers (DPOs) to increase the knowledge and impact of their role. DPOs play an important role in data protection compliance for the organisations in which they have been designated including through providing advice on data protection impact assessments, and monitoring the implantation and efficacy of data protection policies.

As the contact point for the DPC in their organisations, DPOs are an important group of stakeholders, and the DPC is committed to supporting them (as well as non-designated data protection data protection operatives) in making their roles more effective. Because it is part of the requirements of the  GDPR, the DPC must be notified of the formal designation of a DPO by an organisation. At  the end of the 2023 the DPC had been notified of the designation of 3,520 DPO broken down by sector as follows:

Notification of Data Protection Officers Public Sector- 357;

Private Sector -2932; and

Not-for-profit Sector- 231.

DPO Networks

Since the application of GDPR in 2018, a valuable resource for the DPC  and something that is mutually beneficial to all has been the coming together of  networks of DPOs in various sectors  in engaging with those sectors. These networks have also provided forums for the sharing of information and the collaborative development of compliance solutions. In 2023 the DPC engaged with a number of networks, including the Civil Service DPO Network, a grouping of DPOs from across the public sector, and the Health Research Data Protection Network, which brings together DPOs working in hospitals, academia and other settings to address issues arising in data protection and health research.

Focusing on the private and semi-state sectors, the DPC engaged with the DPO Network of the Banking and Payments Federation of Ireland, the DPO network of Telecommunications Industry Ireland/IBEC, and the Insurance Ireland DPO Network/Working Group. These engagements are valuable in allowing the DPC to platform current and upcoming data protection issues affecting these sectors. In December 2023, the DPC brought together a group of DPOs and non-designated data protection champions working in NGOs active in the local community sector to encourage the development of a new network for information sharing and problem solving. The DPC intends to expand on this work in 2024, to increase its reach to sectors and organisations that may be less well resourced than others when it comes to managing data protection compliance.

As another sign of the growing appreciation and value of the work of DPOs the DPC report highlighted the 2023 Co-ordinated Enforcement  Framework (CEF) Topic, ‘The Designation and Position of Data Protection Officers’. Members of the European Data Protection Board (EDPB) had decided to prioritise this topic on the basis of its practical relevance in the overall data protection governance landscape. DPOs, either outsourced or in house, stand in a unique position within the regulatory architecture of the GDPR. They act as intermediaries of sorts between the Supervisory Authorities, individuals and the business units of an organisation.

The DPC had back in 2022 set out a Regulatory Strategy for 2022-2027 and this emphasised the  mutual value and benefits through co-operation and increased communication with DPOs on emerging issues. It seemed the appropriate action to participate and engage in a fact finding role with DPOs and  the basic aims were to:

• Help to identify emerging issues;

• Assess the knowledge, expertise and impact of the DPOs; and

• Generate deeper insights into the role at an EU level.

With these aims, in March 2023 the DPC launched a fact finding exercise by means of a detailed questionnaire to over 100 DPOs all over Ireland. This group of DPOs included ones from the public, private and not for profit sector. All completed questionnaires were collated and resulted in some  findings related to three broad  substantive issues.

Those issues were : a) The resources of the DPO;

b) Conflicts of interest while carrying out the DPO role; and

c) The tasks of the DPO under Art.39.1 (a) to (e).

Some findings

Approximately 33% of respondents replied that they do not have the resources sufficient to fulfil the role of a DPO. Upon further analysis of the responses, it was discovered that the high majority of respondents who stated they do not have adequate resources sufficient to fulfil the role of a DPO came from the Public and Not-for Profit Sector. This supports the position that DPOs are better resourced in the Private Sector.

Approximately 36% indicated that the data protection officers’ tasks are performed in addition to other tasks, but not as the main task. In that regard, it was noted that many of the non-data protection tasks did not complement the role of a DPO such as Health and Safety Officer, Human Resource Officer, Employee Engagement Manager, Communications Officer.

Approximately 80% of DPOs replied they have at least 3 + years of experience working on the application and the interpretation of data protection requirements.

The DPC’s  submissions to the EDPB in Appendix1.2: National Reports on the CEF on DPOs at pp.65-69, where the  DPC expanded on the  three substantive issues referenced above, merit some further commentary.

Resources.

A strong view outlined was that it was increasingly vital that DPOs have adequate and sufficient resources to carry out their tasks as DPOs in an organisation effectively and that the DPO can maintain their expert knowledge (Art 38.2 GDPR). It is concerning that one-third of DPOs state they do not have the adequate resources for the role, and also that some large organisations only have a part-time DPO in place. A part-time position may lead to a lack of clarity as to what is expected in the role and diminish the importance of the role. Such resources can only have a negative impact on the compliance levels of data protection within an organisation. The DPC appreciates that ‘resources’ is not defined under the GDPR; the DPC recommends organisations need to consider the EDPB Guidelines on Data Protection Officers which state the following should be considered by organisations:

• Active support of the DPO’s function by senior management (such as at board level);
• Sufficient time for DPOs to fulfil their duties;
• Adequate support in terms of financial resources, infrastructure (premises, facilities, equipment) and staff where appropriate;
• Official communication of the designation of the DPO to all staff to ensure that their existence and function are known within the organisation;
• Necessary access to other services, such as Human Resources, legal, IT, security, etc., so that DPOs can receive essential support, input and information from those other services; and
• Continuous training. DPOs must be given the opportunity to stay up to date with regard to developments within the field of data protection. The aim should be to constantly increase the level of expertise of DPOs and they should be encouraged to participate in training courses on data protection and other forms of professional development, such as participation in privacy fora, workshops, etc.

The DPC recognised there is no one-size-fits-all while considering  further clarity on what could be regarded as providing adequate resources for DPOs in an organisation may be helpful in addressing address this situation. It may be the case that organisations need a template for what is required to have adequate resources in place for the role of a DPO.

Conflicts of Interest.

Article 38(6) GDPR states: ‘The data protection officer may fulfil other tasks and duties. The controller or processor shall ensure that any such tasks and duties do not result in a conflict of interests’. The DPC noted in the submissions received that a number of DPOs alluded to performing other roles within the organisation. Some of these other roles may have the potential for a Conflict of Interests. Some of the roles noted included:

• General Manager
• Chief Financial Officer
• Chief Executive Officer
• Director of Corporate Services

Whilst the GDPR does not prevent a DPO from fulfilling other non-DPO tasks and duties an organisation must ensure the DPO does not carry out tasks that will not lead to a conflict of interests or the impact on the independence of the Role of Data Protection Officer. Recently the  CJEU has held that a ‘conflict of interests’ may exist when a DPO holds a role or position within an organisation that involves determining the purposes and the means of the processing of personal data.(  CJEU C-453/21 – X-Fab Dresden GmbH & Co. KG). In line with the CJEU decision, the DPC acknowledged  that a conflict of interest must be evaluated on a case-by-case basis and will be specific to  each individual organisation and their structure. The DPC recommends that organisations consider the published EDPB guidance in this which states, depending on the activities, size and structure of the organisation, it can be good practice for controllers or processors to:

• identify the positions which would be incompatible with the function of DPO;
•  draw up internal rules to this effect in order to avoid conflicts of interests;
• include a more general explanation about conflicts of interests;
• declare that their DPO has no conflict of interests with regard to its function as a DPO, as a way of raising awareness of this requirement; and
•  include safeguards in the internal rules of the organisation and to ensure that the vacancy notice for the position of DPO or the service contract is sufficiently precise and detailed in order to avoid a conflict of interests.

Tasks of the DPO

Question 15 of the survey  had asked ‘Have additional tasks been committed to the data protection officer compared to those envisaged in the GDPR?‘.

The DPC noted that the following other tasks are carried out by the DPO.

• Nearly 1/3 of DPOs are involved in the decision making on the processing of personal data.
• Over half develop the organisation’s data protection processes.
• Over half draft or carry out data protection impact assessments.
• Over half fulfil the data subject requests on their data protection rights.
• Almost half draft or negotiate contract such as data processing agreements.
• Over 25% are responsible for the lawfulness of the processing of personal data.

Following responses received the DPC noted  that, in practice, DPOs carry out considerably more tasks with more responsibility than outlined in the GDPR. The DPC observed that  some of these tasks are better served by the organisation, not an independent DPO. For example, over 50% of DPOs, as an additional task, state they draft or carry out DPIAs. Whilst the DPO can play a vital role in carrying out a DPIA by being consulted for advice before or during a DPIA project, it is the controller’s task rather than the DPO’s to carry a DPIA when necessary (Article 35(1) GDPR). Additionally, there is a belief within the DPC that DPIAs should ideally come from the controller and, specifically, the special  unit within the organisation with the best expertise in the area of the DPIA.

At this stage  the DPC  then proceeded to outline some of the positives to emerge from the engagement

Positives.

Article 38(1) and 39 GDPR

It was seen as encouraging by the DPC  that nearly all organisations had as a requirement that the DPO must be consulted on data protection issues, and for the most part, the DPO was  involved or consulted in handling and solving problems related to the processing and protection of personal data in the organisation. (Q25/26). The DPC also saw  as a positive that almost all DPOs stated that, in general, the DPO’s opinions are being followed in the organisation. In addition, the high majority, nearly 75% of DPOs, are documenting why their advice is not being pursued, for example, why a DPIA was not deemed necessary prior to the undertaking of a project. The DPO’s recording of why their advice is not followed and their decision-making process will assist an organisation in meeting its accountability obligations under Article 5(2) GDPR.

Data protection consultants such as us here at  GDPRXPERT.ie are aware that talk is talk , but actions speak louder than words. How many times have data protection advisers been told , ‘we would love to have a DPO but it is hard to convince management /owners’? This is even in organisations where there is a mandatory obligation to appoint a DPO! The EDPB is still  strong  on education and awareness building and understandably wants this mode to continue, at least in the short term. Partly for this reason they asked the DPC to outline some actions taken to attain this goal. Had they, for example, already published general guidance (e.g. guides, guidelines, etc.) regarding DPOs (including before launching the coordinated action).

The DPC response was that they had  published guidance on appropriate qualifications for a Data Protection Officer on their website. This guidance recommends that the appropriate level of qualification and expert knowledge should be determined according to the personal data processing operations carried out, the complexity and scale of data processing, the sensitivity of the data processed and the protection required for the data being processed. Guidance on Who Needs a DPO under Article 37(1) GDPR? has  been published on the website in conjunction with  how to notify the DPC  of a DPO under Article 37 (7) GDPR.

The next query was:  Have you taken action (i.e., fact finding exercises, informal contact, prior consultation, investigation) towards any of the organisations concerning the designation, tasks and/or role of the DPO prior to launching the coordinated action? Please describe the action you have taken and the outcome of this action (e.g. letter, recommendations to the organisation, general guidance, corrective measures such as orders, injunctions with or without an incremental penalty, administrative fines).

Pursuant to its tasks of a supervisory authority contained in Article 57 of the GDPR, in 2020, the DPC commenced a project to assess compliance by public bodies with the Article 37 (1) obligations. From a total of almost 250 public bodies, comprising Government Departments and agencies, as well as Local Authorities, 77 public bodies were identified as being potentially not compliant with the requirements. Engagement is to take place  with each of these public bodies setting out how they are to bring themselves in to compliance with Article 37.7 of the GDPR by the end of 2020, raising the sector’s compliance rate from 69% to 96%. The DPC carried out an Own-Volition Inquiry into one of the public bodies as a result of the monitoring and enforcement exercise above. Pursuant to the tasks of a supervisory authority contained in Article 57 of the GDPR , the body was issued with a reprimand  in respect of the infringements of Articles 31, 37(1), and 37(7) of the GDPR.

Finally, the DPC was asked for any general impression of the levels of awareness and compliance of the organisations that had been consulted concerning the designation, tasks and/or role of the DPO?

The DPC’s general impression of the levels of awareness and compliance of the organisations concerning the designation, tasks and role of the DPO in general was stated to be quite high. In the large majority, almost 80% of DPOs replied they had at least 3 + years of experience working on the application and the interpretation of data protection requirements (Art 37.5 GDPR). This level of expertise broadly matched the DPO’s relevant experience working in the organisation’s particular industry with over 50% stating they have 8+ years in organisations industry or field. A concern was raised by the DPC, however, that the DPO role in some organisations is considered part-time and as previously noted, this may have an impact on the effectiveness of the role. It was noted that this situation arose more in the voluntary and not-for-profit sectors, which may indicate budgetary constraints in those sectors as opposed to organisations in the private sector. In some cases, the DPO could allocate as little as 10% or 20 % of their working hours to performing their tasks and duties, likely impacting effective data protection compliance in an organisation.

Data Breaches.

The DPC’s Regulatory Strategy 2022-2027 recognises the important role DPOs perform in championing data protection in their organisation. Organisations are obligated to notify data protection breaches to the DPC  and such notifications usually come from the DPO who can distinguish minor from major breaches. Working closely with DPOs, The DPC aims to mitigate data breaches where they occur. It is important that an early response is activated to address financial, legal and  reputational risks to organisations as well as vindicating the rights of data subjects involved. ( See DPC Report 2023 at 27).

In 2023 there were 6991 valid GDPR breaches and this represented a 20% increase from 2022. The highest category notified to the DPC was ‘unauthorised disclosure’. This category contained cases affecting one or small numbers of individuals and amounted to 52% of total notifications. ( 3461) Out of the 6991 breaches, 3766 related to the private sector, 2968 to the public sector and the remaining 257 came from the voluntary and charitable sector.

In keeping with the trend of previous years, public sector bodies and banks accounted for the ‘top ten’ organisations with the highest number of breach notifications recorded against them, with insurance and telecom companies featuring prominently in the top twenty. Notably, correspondence issuing to incorrect recipients because of poor operational practices and human error – for example inserting a wrong document into an envelope addressed to an unrelated third party – continues to feature prominently.

Here at GDPRXPERT.ie , we always emphasise to our clients that it is often something very simple that leads to a data breach. It is not caused by an overwhelming breach of security but rather  by some human error. This is borne out by the statistic from the 2023 Report that  51.66% of breaches are a result of emails or postal material going to the incorrect recipient. ( 1203 for the former, 2255 for the latter). These seem abnormally high but the facts speak for themselves. Clearly a large number can be avoided by extra vigilance before posting or pressing the Send button!!

The report also outlined some of the more notable inquiries and related enforcement actions that concluded in 2023.

These give a flavour of the issues and fines that are being seen  in the context of  violations of the GDPR. In the case of Centric Health, Bank of Ireland and Kildare Co.Council , in November 2023 the DPC had its decision to impose the fines confirmed in the Dublin Circuit Court.  As part of data protection training GDPRXPERT.ie like to give insights into case law and cases from the DPC.  All of these are  warmly received by those undergoing training as they give practical examples of the GDPR in action without having to go into the very technical details in all cases.

In a previous blog we looked at the TikTok case referenced above and we may be looking at TikTok again in a future blog  in relation to another fine imposed by the DPC,  one which they will be appealing. This involves unlawful transfer of personal data to China.

“The Irish Data Protection Commission has today announced its final decision following an Inquiry into TikTok Technology Limited (“TikTok”). This Inquiry was launched by the DPC, in its role as the Lead Supervisory Authority for TikTok, to examine the lawfulness of TikTok’s transfers of personal data of users of the TikTok platform in the EEA to the People’s Republic of China (“China”). In addition, the Inquiry examined whether the provision of information to users in relation to such transfers met TikTok’s transparency requirements as required by the GDPR.

This  strong decision, which was made by the Commissioners for Data Protection, Dr Des Hogan and Mr Dale Sunderland, and has been notified to TikTok, finds that TikTok infringed the GDPR regarding its transfers of EEA User Data to China [2] and its transparency requirements . A part of the decision sets out administrative fines totalling €530 million and an order requiring TikTok to bring its processing into compliance within 6 months.  On top of this and included with the decision is an order suspending TikTok’s transfers to China if processing is not brought into compliance within this timeframe”.

Concluding Remarks

The Annual Report of the DPC for 2023 shows the breadth of the work undertaken throughout that year and some work that only concluded in 2023 as a result of intensive research and investigation. It is indeed fair to say that the DPC sought to defend an  individual’s right to proper protection of their personal data through fair and proportionate regulation, in line with all applicable legal frameworks and a continuously evolving body of case law.

Patrick Rowland for GDPRXPERT.ie

GPRXPERT.ie offers a comprehensive  data protection consultancy service with particular emphasis on the onerous responsibilities placed on organisations under the GDPR.

The DPC decision in the TIK Tok case has been welcomed by data protection practitioners.  It is  is one we have been meaning to discuss but did not get around to it until now. Also, The DPC Annual Report for 2023 has just been released and we will examine it in detail in our upcoming July/August 2024 blog.
As the report states, “2023 was a busy year in personal data rights protection. The year saw a significant increase in complaints dealt with by the Data Protection Commission (“DPC”) with record fines issued and corrective orders imposed following cross-border and national inquiries. More generally, there were a large number of data protection-related judgments from the Court of Justice of the European Union and continued domestic focus before the Irish courts”. Perhaps not coincidentally, 2023 was also a busy year for GDPRXPERT and those operating a data protection advisory service. In particular, there was a high demand for the outsourced data protection officer service provided by GDPRXPERT.ie

Naturally, many of the high profile cases taken and concluded by the DPC in 2023 feature prominently in the report. One of these is the Tik Tok case concluded in September 2023. This concluded with a fine of €345 million for TIK Tok. TikTok Is a video focused social media platform that allows registered users to create and share videos of varying duration and to communicate with others through messages. TTL states that TikTok is not a social network and is, rather, a global entertainment platform that, at its core, was designed to enable users to create and share video content, enjoy videos from a variety of creators and otherwise express their creativity, such as by interacting with videos to express new perspectives and ideas.

The Tik Tok platform is accessible via a standalone mobile phone application and can also be viewed as a web page from a web browser.
This case is worthy of some more analysis and comment because it is a transparent example of the whole process involved , and it is a long and resource intensive process. The Tik Tok case has been welcomed by GDPR and data protection practitioners GDPRXpert.ie. and many others. Indeed, it has been welcomed by GDPRXpert.ie and fellow GDPR and data protection law experts across the EU. In previous blogs here GDPRXpert.ie have emphasised the length of time it can take to bring a case to a conclusion. The length of time it can take to finalise investigations has been the subject of much criticism by some groups who themselves are familiar with the process and its complexities. They should know better and they most likely do, but they persist in rushing to premature judgment in some cases and have done so very notably in one specific case.

These same groups have their own underlying agenda and their criticism of the DPC may not diminish despite clear robust decisions, such as in the Tik Tok case. One particular group we have criticised before seems to have happily deluded itself into believing it is best placed to monitor and defend the data protection rights of all data subjects. It does this at the cost of neglecting areas within its own more direct remit. Its misguided forays into areas already well served by the DPC has seen it succumb to the desire to take frivolous, and arguably vexatious actions paid for by donors and the Irish taxpayer. In its most recent opportunistic legal venture challenging the DPC in the context of Google’s online bidding, the judge sent a clear message by ordering the group to pay the costs of the DPC. It was seen in this case to be totally out of its intellectual comfort zone and showing signs of a dearth of understanding of data protection law.

The Tik Tok case stands as a testament to the quality of the investigations carried out by the DPC. One must emphasise that the Tik Tok investigation was an own volition inquiry but nevertheless involved the coordinated deployment of huge assets and resources. It may be that the nature of an own volition inquiry makes additional resources necessary because of the extra scrutiny they attract by virtue of the GDPR. These types of cases take time; simple as that. This case does demonstrate the multitude of resources that must be strategically expended in order to bring such complex cases to the desired legal conclusion( was subject of Binding Decision 2/2023 on the dispute submitted by the Irish SA regarding TikTok Technology Limited (Art. 65 GDPR) Adopted on 2 August 2023). These cases are complicated even for data protection experts such as GDPRXPERT.ie

Preliminary Issues
Before the case proper a few mainly procedural issues had to be clarified. The first was whether the DPC was competent to act as the Lead Supervisory Authority at all. Under 4(23) GDPR cross border processing is defined as meaning either :
(a) processing of personal data which takes place in the context of the activities of establishments in more than one Member State of a controller or processor in the Union where the controller or processor is established in more than one Member State;
or
(b) processing of personal data which takes place in the context of the activities of a single establishment of a controller or processor in the Union but which substantially affects or is likely to affect data subjects in more than one Member State.
During the period 29 July 2020 and 31December 2020 ,Tik Tok Technology Ltd (TTL) processed personal data in the context of the activities of a single establishment of a controller or processor in the Union but which substantially affects or is likely to substantially affect data subjects in more than one Member State. TTL’s single establishment in Ireland is supported by affiliated entities in Germany, France, Poland, Italy, Spain and Sweden.
There was no doubt that the processing was cross border.

Turning to the question of whether the DPC was competent to act as lead supervisory authority in respect of the processing under examination, the DPC noted that Article 56(1) GDPR provides that a supervisory authority of the main establishment of a controller or processor shall be competent to act as lead supervisory authority pursuant to Article 60 GDPR.
Having considered all of the above and the nature of the processing at issue, the DPC was satisfied that TTL is a data controller within the meaning of Article 4(7) GDPR regarding the processing which is the subject of the inquiry. The DPC was further satisfied that TTL has its main establishment in Ireland for the purposes of the GDPR. As such, the DPC was satisfied that the requirements of Article 56 GDPR had been met in relation to the processing at issue, such that the DPC is competent to act as the lead supervisory authority in respect of the cross-border processing under examination.
So, the DPC is competent to act as Lead Supervisory Authority (LSA).

The next hurdle to be crossed concerned the argument by TTL that the standards of compliance to which it was being held post dated the relevant period of the inquiry. The argument was that the “Fundamentals of a Child -Oriented Approach to Data Processing” (published Dec. 2021) were not in effect at the time of the processing giving rise to the inquiry and therefore, constituted “an impermissible retrospective application of regulatory standards and a clear breach of fair procedures.”
The DPC dismissed this by relying on the plain fact that GDPR was in force at the time, and something such as the Fundamentals represented ancillary guidance to the GDPR, but TTL was obliged to comply with GDPR since May 2018. The Fundamentals referenced the GDPR principles that were in effect in 2018 and although the Fundamentals were not in effect contemporaneously, they did not constitute any form of retrospective law making. They are post GDPR guidance principles only. The date of their release is immaterial and irrelevant. TTL’s compliance was to be assessed in the light of the GDPR and any guidance notes and material available during the relevant period.
Time for Substantive Issues.
So then, what was the DPC actually investigating in the case?

Material Scope.

This inquiry concerned the processing by TTL of personal data of registered child users of the TikTok platform and whether or not TTL had complied with its obligations under the GPR as data controller. The 2018 Act provides that the term ‘child’ in the GDPR is retaken as a reference to a person under the age of 18 years. TTL provides the TikTok platform to persons over the age of 13. As a result, the term child users in this decision should be taken as a reference to registered TikTok users who are aged between 13 and 17 years old. As set out below, this inquiry also examined certain issues regarding TTL’s processing of personal data relating to children under the age of 13.
In particular, this inquiry concerned two distinct sets of processing operations by TTL in the context of the TikTok platform, both of which constituted the processing of personal data as defined by Article 4(2) GDPR. The inquiry also examined the extent to which TTL complied with its transparency obligations under the GDPR. As highly experienced data protection law consultants, GDPRXpert.ie can testify to the challenges organisations face in meeting transparency standards set by GDPR. The standards are high and will not be met without a strategy being devised and followed. Our GDPR audits often discover that organisations have no strategy at all.
Broadly, the first type of processing to be examined relates to the processing of child users’ personal data in the context of the platform settings of the TikTok platform, both mobile application and website based, in particular published by default processing of such platform sessions in relation to Child Users’ accounts, videos, comments, ‘Duet’ and ‘Stitch’, downloading and ‘Family Pairing’.
The second type of processing to be examined related to the processing by TTL of the personal data of children under the age of 13 in the context of the TikTok platform, both mobile application and website based, in particular for the purposes of age verification.
Finally, with regard to the processing of personal data of persons under the age of 18 in the context of the TikTok platform (including any such processing connection with websites or applications which provide access to the TikTok platform), this inquiry also examined if TTL had complied with its obligations to provide information to data subjects in the form and manner required by Articles 12(1). 13(1)(e), 13(2)(a), 13(2)(b) and 13(2)(f) GDPR.

Assessment of TTL’s Compliance with the GDPR and Corrective Powers.

The Statement of Issues identified the matters for determination as part of the inquiry. Those issues concerned TTL’s compliance with the GDPR ( and consideration of corrective powers), as follows:
Firstly, in relation to platform settings:
• A. Whether, having regard to the default public settings applied to Child Users’ accounts, TTL implemented appropriate technical and organizational measures pursuant to Article 24, GDPR, to ensure and to be able to demonstrate that its processing of Child Users’ personal data was performed in accordance with the GDPR;
• B. Whether, having regard to the default public settings applied to Child Users’ accounts TTL complied with its obligations under Article 5(1)(c) and 25(1) GDPR to ensure that its processing of Child Users’ personal data was adequate, relevant and limited to what is necessary in relation to the purposes for which they were processed; and to implement appropriate technical and organizational measures designed to implement the data minimisation principle in an effective manner and to integrate the necessary safeguards into the processing in order to meet the requirements of this regulation and protect the rights of data subjects;
• C. Whether, having regard to the public default settings applied to Child Users’ accounts, TTL complied with its obligations under Article 25(2) GDPR to implement appropriate technical and organisational measures for ensuring that, by default, only personal data which are necessary for each specific purpose of the processing were processed; and
• D. Whether, in circumstances where TTL’s platform settings allowed an unverified non Child User to access and control a Child Users’ Platform settings, TTL complied with its obligations under articles 5(1)(f) and 25(1) GDPR to ensure that its processing of Child Users personal data was processed in a manner that ensured appropriate security of the personal data, including protection against unauthorized or unlawful processing and against accidental loss, destruction or damage, using appropriate technical organizational measures; and to implement appropriate technical and organisational measures designed to implement the integrity and confidentiality principle in an effective manner and to integrate the necessary safeguards into the processing in order to meet the requirements of this Regulation and protect the rights of data subjects.

Secondly in relation to age verification:
• Whether, having regard to TTL’s requirement that users of Tik Tok should be aged 13 and above, TTL complied with its obligations under Art. 24 GDPR to implement appropriate technical and organisational measures to ensure and be able to demonstrate that its processing of data of Child Users was performed in accordance with the GDPR, including by implementing measures to ensure against children under 13 years of age accessing the platform ;

• Whether, having regard to TTL’s requirement that users of TikTok should be aged 13 and above, TTL complied with its obligations under Art.5(1)(b),5 (1)(c) and 25(1)GDPR to ensure that it collected Child Users’ personal data for specified , explicit and legitimate purposes and that it did not further process that data in a manner incompatible with those purposes; to ensure that its processing of Child Users’ personal data was adequate ,relevant and limited to what was necessary in relation to the purposes for which they were processed; and to implement appropriate technical and organisational measures designed to implement the purpose limitation and data minimisation principles in an effective manner and to integrate the necessary safeguards into the processing in order to meet the requirements of the GDPR and protect the rights of data subjects , including by implementing measures to ensure against children aged under 13 having access to the platform;

• Whether, having regard to TTL’s requirement that users of TIK Tok should be 13 and over , TTL complied with its obligations under Art. 25 (2) GDPR to implement appropriate technical and organisational measures for ensuring that, by default, only personal data which were necessary for each specific purpose of the processing were processed, including by implementing measures to ensure against children aged under 13 accessing the platform.
Thirdly, in relation to transparency:
• Whether Child Users are appropriately made aware as a user of Tik Tok of the various public and private account settings in accordance with Art.5(1)(a), 12(1), 13(1)(e), 13(2)(a) and 13(2)(f); to be read in conjunction with Recitals 38,39, 58, 60 and 61, and whether Child Users are able to determine the scope and consequences of registering as a user, and specifically that their profile will be defaulted to public.
These were the complicated issues that the DPC had to assess in light of the legal regime.Therefore, the first substantive issue arose in regard to platform default settings and in the specific context of child users.
Issue 1: Assessment and consideration of matters concerning TTL’s compliance with articles 5, 24 and 25 GDPR concerning its platform settings for users under age the age of 18.
The root question was whether TTL had complied with its obligations under Articles 5(1)(c), 5(1)(f), 24 and 25 GDPR. Article 5(1)(c) GDPR provides that personal data shall be “adequate, relevant and limited to what is necessary in relation to the purposes for which they are processed.” Per Recital 39, this requires, in particular, ensuring that the period for which the personal data are stored is limited to a strict minimum. Personal data should be processed only if the purpose of the processing could not reasonably be fulfilled by other means. In order to ensure that the personal data are not kept longer than necessary, time limits should be established by the controller for erasure or for a periodic review.
Article 5(1)(f) provides that personal data shall be “processed in a manner that ensures appropriate security of the personal data, including protection against unauthorised or unlawful processing and against accidental loss, destruction or damage, using appropriate technical or organisational measures.” Per Recital 39, personal data should be processed in a manner that ensures appropriate security and confidentiality of the personal data, including for preventing unauthorised access to, or use of, personal data and the equipment used for the processing.
Further, Article 24(1) provides: Taking into account the nature, scope, context and purposes of processing as well as the risks of varying likelihood and severity for the rights and freedoms of natural persons, the controller shall implement appropriate technical and organisational measures to ensure and to be able to demonstrate that processing is performed in accordance with this Regulation. Those measures shall be reviewed and updated where necessary.
The GDPR and data protection advisory service provided by GDPRXpert.ie always emphasises the importance attached to the technical and organisational measures that are implemented. It is not enough to implement measures; they must be demonstrably ‘effective’. To quote Recital 74 GDPR, “ The responsibility and liability of the controller for any processing of personal data carried out by the controller or on the controller’s behalf should be established. In particular, the controller should be obliged to implement appropriate and effective measures and be able to demonstrate the compliance of processing activities with this Regulation, including the effectiveness of the measures. Those measures should take into account the nature, scope, context and purposes of the processing and the risk to the rights and freedoms of natural persons.” GDPR audits conducted by GDPRXpert.ie will never overlook this potential pitfall. Unfortunately, it is missed by many.

In regard to Art.25, the European Data Protection Board (EDPB) has published Guidelines on Data Protection by Design and Default. These have summarised Art.25 GDPR as follows: “ The core of the provision is to ensure appropriate and effective data protection both by design and by default, which means that controllers should be able to demonstrate that they have the appropriate measures and safeguards in the processing to ensure that the data protection principles and the rights and freedoms of data subjects are effective. ( European Data Protection Board, ‘Guidelines 4/2019 on Article 25 Data Protection by Design and by Default’ (20 October 2020) at [2]).
As with the technical and organisational measures referred to above, it is the effectiveness of the implemented measures that is crucial. Each implemented measure should produce the intended results for the processing foreseen by the controller and this has two consequences as laid out in the EDPB Guidelines:
“First, it means that Article 25 does not require the implementation of any specific technical and organisational measures, rather that the chosen measures and safeguards should be specific to the implementation of data protection principles into the particular processing in question. In doing so, the measures and safeguards should be designed to be robust and the controller should be able to implement further measures in order to scale to any increase in risk. Whether or not measures are effective will therefore depend on the context of the processing in question and an assessment of certain elements that should be taken into account when determining the means of processing. …Second, controllers should be able to demonstrate that the principles have been maintained.”

On a daily basis our data protection law consultants here at GDPRXpert.ie are reminded of the interaction of the necessary congruence of technical and organisational measures that are incorporated into processing operations with data protection principles, especially data minimisation.
Article 25(2) GDPR requires data controllers to implement measures to ensure that, by default, the principle of data minimisation is respected, as follows: “The controller shall implement appropriate technical and organisational measures for ensuring that, by default, only personal data which are necessary for each specific purpose of the processing are processed. That obligation applies to the amount of personal data collected, the extent of their processing, the period of their storage and their accessibility. In particular, such measures shall ensure that by default personal data are not made accessible without the individual’s intervention to an indefinite number of natural persons.” The obligation to implement the measures described in Art 25(2)GDPR is referred to as Data Protection by Default. By default, personal data must not be made accessible without the individual’s intervention to an indefinite number of natural persons.
As we often remind clients; no specific measures are prescribed by GDPR. If you have a toothache you want to take something to kill that pain but experience will tell you the same medication may not be effective against pain in another location. It is, therefore, controllers who know the appropriate measures that historically have worked. They should assess the risk and implement what will work for an increased risk in the future.

TTL responded to the Art. 5.(1) (c) and submitted that the data minimisation principle did not mandate processing the absolute minimum but rather, what was adequate, relevant and limited to what was necessary in relation to the purposes of the processing and which respected the principle of proportionality.
Their submission on Art.24 was detailed and focused mainly on a few core points. The first was that Arts.24(1) and 24(2) did not impose prescriptive obligations as that would be inconsistent with the objectives of the provisions themselves, which is to embed privacy compliance practices into the internal practices of an organisation in a manner appropriate to the processing activities undertaken by a particular organisation. TTL cited Art.29 Working Party as support for the argument that a one size fits all approach would force controllers into structures that are ‘unfitting and ultimately fail’. Tik Tok took the view that the only option was ‘custom built solutions. By reasonable interpretation, the accountability obligations under Art.24(1) could only be open-ended and non-prescriptive.

TTL also argued that the GDPR does not mandate the exact means of achieving or demonstrating compliance with its requirements. Taking such a prescriptive approach would be inconsistent with the core objective of Art.24 which, as we have just stated, is to embed privacy compliance into the internal practice of organisations in a manner that works for each organisation while remaining aligned with GDPR principles. Data protection consultants GDPRXPERT.ie would agree with TTL that with Art.24 there is a much more holistic approach to data protection compliance and indeed, there has to be. If not, there would have to be a formulaic, universal manner by which an organisation had to display compliance.
We know that under Art.24 GDPR the controllers are required to implement technical and organisational measures to ensure that processing is carried out in accordance with the GDPR and be able to demonstrate such compliance. In order to meet the requirement controllers must make an assessment of (1) the nature, scope , context and purposes and (2) the risks of varying likelihood and severity for the rights and freedoms of natural persons.
TTL contended therefore that there was sufficient leeway within the confines of the Article to allow for some discretion as to what was an appropriate measure. They further argued that it is clear, therefore, that the appropriateness of the measures adopted must be informed by an assessment of the context and purposes of processing, as well as the risks which may result from the processing (if any). As explained above, TikTok’s mission is to inspire creativity and bring joy. The core purpose of the Platform during the Relevant Period was to enable Users to disseminate their own content and to show Users content they are likely to find of interest.
TikTok then moved to their position in relation to Art.25 and stated “ Article 25(1) GDPR does not solely focus on user controlled settings as a technical measure but also addresses technical measures more broadly (including ones that are not user controlled) and organisational measures. As such, TikTok as a data controller is afforded autonomy and appropriate latitude in determining the specific designs of its product.” The measures to be adopted in Article 25(1) GDPR should be commensurate with the risks posed by the processing, and those risks should be weighed by their likelihood and severity.

TTL then looked to opinions from the EDPB to bolster their argument. “The European Data Protection Board (“EDPB”) Article 25 Data Protection by Design and Default Guidelines (“Article 25 Guidelines”) recognise that Article 25(1) GDPR does not envisage a one-size fits all approach to data protection. The EDPB Article 25 Guidelines further state “[w]hen performing the risk analysis for compliance with Articles 25, the controller has to identify the risks to the rights of data subjects that a violation of the principles presents and determine their likelihood and severity in order to implement measures to effectively mitigate the identified risks.”
Article 25(2) states, among other things that “the controller shall implement appropriate technical and organisational measures for ensuring that, by default, only personal data which are necessary for each specific purpose of the processing are processed”. Article 25(2) requires that, by default, only the personal data that is necessary for each specific purpose is processed. It is the responsibility of the controller to define the purpose of the processing, and by doing so, the controller also determines the scope of the processing required for that particular purpose. Article 25(2), therefore, requires implementing default settings to processing that is necessary to achieve the controller’s purpose. Article 25(2) is not prescriptive as to the type of technical and organisational measures that must be implemented to ensure data protection by default. The EDPB has recognised that a range of different measures, including enabling data subjects to intervene in the processing, could be involved “depending on the context and risks associated with the processing in question”.

The context of the processing is central to the consideration as to what measures are appropriate in the given circumstances and to what extent they will implement data protection principles effectively. In particular, Article 25(2) does not require controllers to choose default settings which would subvert the core functionalities of their service. In order to comply with Article 25(1) GDPR, controllers are asked to weigh a multitude of broad and abstract concepts, assess the risks, and then determine “appropriate” measures. Each of these elements is opaque and open to interpretation, and as a result, no two assessments performed in accordance with Article 25 will look the same. Article 25(1) requires “appropriate” measures, which when applied to age verification would mean that a controller is required to implement measures to determine the age of users with an appropriate, rather than absolute, level of certainty.

Article 25(1) GDPR does not prescribe the appropriate technical and organisational measures designed to implement the data protection principles (including the data minimisation principle) that organisations are required to put in place. Controllers are similarly afforded autonomy and appropriate latitude under Article 25(2) GDPR in determining the appropriate measures for ensuring privacy by default. The European Data Protection Board (“EDPB”) in its Article 25 Data Protection by Design and by Default Guidelines (“Article 25 Guidelines”) explains that being appropriate means that the measures and necessary safeguards should be suited to achieve the intended purpose, i.e. they must implement the data protection principles effectively” and that “the controller must verify the appropriateness of the measures for the particular processing in question”.
Further, in considering whether the measures put in place by TikTok complied with Article 25(1) GDPR, account must be taken, in particular, of the “context and purposes of processing”. In this regard, full consideration must be given to the benefits of the relevant features to Users and their importance to the core purpose of TikTok during the Relevant Period as described above, which would have informed younger Users’ expectations, and the measures and privacy settings designed to safeguard younger Users.
All of these submissions had then to be taken into account by the DPC.
The first finding by the DPC
At the time of the Relevant Period, TTL implemented a default account setting for Child Users which allowed anyone (on or off TikTok) to view social media content posted by Child Users. In this regard, the DPC was of the view that TTL failed to implement appropriate technical and organisational measures to ensure that, by default, only personal data which were necessary for TTL’s purpose of processing were processed. In particular, this processing was performed to a global extent and in circumstances where TTL did not implement measures to ensure that, by default, the social media content of Child Users was not made accessible (without the user’s intervention) to an indefinite number of natural persons. It was held by the DPC that the above processing by TTL was contrary to the principle of data protection by design and default under Article 25(1) and 25(2) GDPR, and contrary to the data minimisation principle under Article 5(1)(c) GDPR.

The second finding by the DPC:
During the Relevant Period, TTL implemented a default account setting for Child Users which allowed anyone (on or off TikTok) to view social media content posted by Child Users. The above processing posed severe possible risks to the rights and freedoms of Child Users. In circumstances where TTL did not properly take into account the risks posed by the above processing, the DPC took the position that TTL did not implement appropriate technical and organisational measures to ensure that the above processing was performed in accordance with the GDPR, contrary to Article 24(1) GDPR.
The third finding by the DPC
During the Relevant Period, TTL implemented a platform setting – called ‘Family Pairing’ for Child Users whereby a non-Child User could pair their account to that of the Child User. This platform setting allowed the non-Child User to enable direct messages for Child Users above the age of 16. The above processing posed severe possible risks to the rights and freedoms of Child Users. In circumstances where this processing does not ensure appropriate security of the personal data, including protection against unauthorised or unlawful processing and against accidental loss, destruction or damage, using appropriate technical or organisational measures; and TTL failed to implement appropriate technical and organisational measures designed to implement the integrity and confidentiality principle in an effective manner and to integrate the necessary safeguards into the processing in order to meet the requirements of the GDPR and protect the rights of data subjects. DPC took the view that this processing was not performed in accordance with the GDPR, contrary to Article 5(1)(f) and Article 25(1) GDPR. ( at p.42)
The DPC also made an assessment and consideration of matters concerning age verification pursuant to articles 24 and 25 GDPR
The fourth finding by the DPC.
During the Relevant Period, TTL implemented a default account setting for Child Users which allowed anyone (on or off TikTok) to view social media content posted by Child Users. The above processing posed severe possible risks to the rights and freedoms of Child Users. This also posed several possible risks to the rights and freedoms of children under the age of 13 who gained access to the platform. In circumstances where TTL did not properly take into account the risks posed by the above processing to children under the age of 13, the DPC was of the view that TTL did not implement appropriate technical and organisational measures to ensure and to be able to demonstrate that the above processing was performed in accordance with the GDPR, contrary to Article 24(1) GDPR.
The DPC also examined transparency requirements under Arts. 5, 12, and 13 GDPR but at this stage we will not go through all of TTL’s submissions and we will conclude with the transparency obligations and the remaining DPC findings.
The first transparency obligation for consideration was whether Child Users were appropriately made aware (in a concise, transparent, intelligible and easily accessible form, using clear and plain language) by TTL as a user of the TikTok platform of the various public and private account 239. settings in accordance with Articles 5(1)(a), 12(1), 13(1)(e), 13(2)(a) and 13(2)(f) GDPR; to be read in conjunction with Recitals 38, 39, 58, 60 and 61 GDPR, and whether Child Users are able to determine the scope and the consequences of registering as a user, whether public or private.
The second transparency obligation for consideration was whether Child Users were appropriately made aware by TTL as a user of the TikTok platform of the public default setting in accordance with Articles 5(1)(a), 12(1), 13(1)(e), 13(2)(a) and 13(2)(f) GDPR; to be read in conjunction with Recitals 38, 39, 58, 60 and 61 GDPR, and whether Child Users were able to determine the scope and the consequences of registering as a user, and specifically that their profile would be defaulted to public.
Finding 5
In circumstances where TTL did not provide Child Users with information on the categories of recipients or categories of recipients of personal data, DPC found that TTL has not complied with its obligations under Article 13(1)(e) GDPR.
In circumstances where TTL did not provide Child Users with information on the scope and consequences of the public-by-default processing (that is, operating a social media network which, by default, allows the social media posts of Child Users to be seen by anyone) in a concise, transparent and intelligible manner and in a form that is easily accessible, using clear and plain language, in particular insofar as the very limited information provided did not make it clear at all that this would occur, the DPC found that TTL had not complied with its obligations under Article 12(1) GDPR.
Finding 6:
For the reasons established by the EDPB in the Article 65 Decision, TTL infringed the principle of fairness pursuant to Article 5(l)(a) GDPR.
TTL were ordered to bring their processing into compliance, received a reprimand and were fined in total €345 million.
We have done a sort of synopsis of the main issues in this case but it is impossible to fully do justice to the effort on the part of the DPC to uphold and vindicate the rights of data subjects, often achieved despite the criticism levelled at the office from the usual suspects. However, it should give readers a glimpse into the complexity of some of the cases that land on the desk of the DPC.

GPRXPERT.ie offers a comprehensive  data protection consultancy service with particular emphasis on the onerous responsibilities placed on organisations under the GDPR.

Patrick Rowland for GDPRXPERT.ie

www.gdprxpert.ie