Action by regulator follows £12.7m fine by UK for illegally processing data of 1.4m children under 13