As companies implement new security controls to improve their GDPR compliance, privacy breaches keep giving rise to more investigations. In March 2021, the Dutch Data Protection Authority uncovered a privacy breach and fined Booking.com for late data breach reporting. Failing to report this personal data violation within 72 hours in 2019, Booking.com was fined 475 000 euros.[1]
More recently, in July 2021, was the turn of TikTok, accused of violating children’s privacy. As one of the biggest social media companies, TikTok users amount to 3.5 million in the Netherlands only, among which over a million include children between the age of six and nineteen years old.[2] By using the TikTok app, children consent to see their personal data exposed to a limited extent. However, their right to be informed about the collection and use of their personal data is required by the transparency requirements under Article 13 and 14 of the GDPR and should be respected. As TikTok failed to make it clear to its users, and especially young children, what their data was used for, the company was found to violate Dutch children’s privacy, a particularly vulnerable legal category of users.[3]
Indeed, the explanation of data process provided by TikTok and thus available to Dutch users was only available in English between May 2018 and July 2020. After July 2020, TikTok released a Dutch version of its privacy statement. This failure to provide information about the process of users’ data was found to result in a privacy breach and was tackled by the Dutch Data Protection Authorities (DDPA) that imposed the company a fine of 750,000 euros in July 2021. The investigation led on TikTok data breach took place in 2020 while the company still had a permanent office in the EU. However, in 2020, Tiktok settled in Ireland, thus falling outside of the EU’s jurisdiction.[4] As mentioned by the DPA’s deputy chair Monique Verdier, the investigation was transferred to the Irish Data Protection Commission and the final ruling lies now on Ireland’s shoulders.[5]
Other data-related cases against Tiktok are still pending. For example, ConsumentenBond, a non-profit group is accusing TikTok of harvesting unlawfully personal data from its users and is now claiming €1.5 billion from the company. ConsumentenBond, together with Take Back Your Privacy, a foundation, are still claiming damages for Dutch children.[6]
Another foundation, called the Foundation for Market Information Research (SOMI), acting at a European level, is also suing the Chinese company. Indeed, it accuses TikTok of failing to protect children’s safety and of breaching European advertisement and privacy rules.[7] Approximately 64 000 parents already joined the foundation in this trial, claiming some €1.4 billion damages. Tiktok encourages children in participating in dangerous challenges, features harmful content by sexualizing children’s body, setting unachievable beauty standards. As this content is harmful and breaches Europe’s privacy rules regarding TikTok’s data collection, legal procedures keep being started against the social media giant.
In the world we live in today, it is very important to know what personal data you choose to give companies access to by clicking a button and how this data is used. Children, especially, should be extensively educated and informed on the consequences of what data they share online. Social medias have to be used carefully and legal actions continue to be taken to limit those privacy breaches in hope to regulate it better.
[1] Dutch Regulator Fines Booking.com 475,000 Euros for Late Breach Reporting, Hunton Privacy blog, April 2 2021, retrieved from
[2] Netherlands hits TikTok with €750,000 fine for child privacy violations, NL Times.nl, July 22 2021, retrieved from
[3] Dutch DPA: TikTok fined for violating children’s privacy, European Data Protection Board, July 22 2021, retrieved from
[4] Netherlands hits TikTok with €750,000 fine for child privacy violations, NL Times.nl, July 22 2021, retrieved from
[5] Dutch DPA: TikTok fined for violating children’s privacy, European Data Protection Board, July 22 2021, retrieved from
[6] Netherlands fines TikTok over English-only privacy terms, DW, July 22 2021, retrieved from
[7] Dutch foundation representing over 60,000 parents takes TikTok to court, Dutch News.nl, June 2 2021, retrieved from:
