Ireland’s Data Protection Commission (DPC) launched an own-volition inquiry into TikTok’s processing of personal data of registered users between the ages of 13 and 17, as well as certain issues regarding TikTok’s processing of personal data of children under the age of 13, in September 2021.

The watchdog — the lead supervisory authority for TikTok in the EU — issued its draft decision in that inquiry last September.

However, a number of European data protection authorities objected to the draft decision, in particular around whether there had been an infringement of data protection by design and default with regard to age verification, and whether there had been an infringement of the principle of fairness with regard to certain design practices.

The issue was therefore referred to the EDPB, which yesterday adopted a binding dispute resolution decision under Article 65 of the GDPR.

The DPC will now adopt a final decision on the basis of the EDPB binding decision, taking into account the EDPB’s legal assessment, within one month. The EDPB decision will be published after the DPC has notified its national decision to TikTok.

In a number of cases involving Big Tech firms, fines proposed by the DPC have been significantly increased following referral to the EDPB. In January, the DPC imposed fines totalling €390 million on Facebook and Instagram owner Meta following an EDPB intervention, having originally proposed fines of just €59 million.