Should we fear for TikTok's data?

TikTok has become one of the most popular social media apps among young people in recent years, on which entertaining and ultra-short videos pass by on a user's personalized timeline. What many people do not know is that the platform originated in China and is managed from there. In 2012, parent company ByteDance was founded in Beijing, which launched its domestic app Douyin in 2016. Douyin became the blueprint for its international variant, which we now know as TikTok, the following year. Since then, that video service has grown to more than 1 billion annual users. This extreme growth, however, was not without controversy.

The revelations by various journalistic media that decisions from China were being imposed on the American branch of TikTok to remove (politically tinged) videos put the company in a bad light in 2019. 1) It also faced sky-high fines for violating the privacy rights of minors. TikTok has responded seriously to these allegations of privacy violations and says it has done a lot of work in recent years to improve its privacy terms more accessible. Its transparency report would show that data from its users would never have been shared with the Chinese government. 2) However, a 2019 US court case seems to indicate otherwise, while TikTok's terms of use state that the company may share data with Douyin where appropriate. 3) 4) Now what are the exact dangers of TikTok sharing data, for example, with the Chinese government?

First, a look at China itself

Data&Privacyweb asks Rogier Creemers. He is an assistant professor at Leiden University and a specialist in Chinese policymaking on digital technologies. He has examined emerging technologies and their political applications before, including China's infamous social credit system 5). During our conversation with him, we look at the importance of data within Chinese society. Creemers: "It's not that easy for Chinese government agencies to get their hands on personal data from Chinese digital companies. In fact, Chinese companies are pretty good at preventing the massive siphoning of large amounts of data to the government." He continued: "Of course, when a Person of Interest is identified for police reasons, Chinese government agencies can more quickly go to companies and say: give us everything you have."

According to Creemers, there is not much to fear for the average foreign user of a Chinese platform. Creemers: "The resources of the Chinese government are also limited. Unless someone is in the spotlight of the Chinese government for some reason, the chances are very small that the Chinese government is interested in the average Dutchman buying toys for his or her child on AliExpress." The same goes for TikTok. So China's focus seems to be somewhere other than spying on the doings of European children, let alone the Dutch.

EU's lack of clout

So the fear that all the data of Dutch children is flowing through to the servers of the Chinese government seems so far unfounded, especially when contrasted with the interference of American tech companies such as Google or Meta (Facebook's parent company). However, regulating the flow of information on a dominant platform in children's experience would deserve a bigger place on the political agenda. But even more worrying than China's role is the lack of clout of European regulators to monitor such activities by non-European parties.

The Dutch Autoriteit Persoonsgegevens has long struggled with financial shortfalls. Also in 2021, despite imposing a €750,000 fine on TikTok, its investigation into TikTok was halted because TikTok's European headquarters was moved to Dublin. Curiously, this also happened to French, Danish and English regulators, who had been investigating TikTok's privacy violations. All the various investigation results from multiple countries had to be reluctantly turned over to the Irish Data Protection Commission, which has now become responsible 6). This investigation is still ongoing as TikTok continues to grow within European borders.

Outlook

So it's not primarily about Tiktok, or that it's a Chinese app. It's a broader story: how to deal with non-European platforms. Sandwiched between the old digital powerhouse in the U.S. and emerging tech industries from Asia, Europe is, after all, a pool of potential platform users in which several non-European platforms are fishing. Multiple studies from the US and Australia show how to better deal with foreign platforms. 7) 8) These papers argue that governments should set clear criteria in advance for foreign platforms before they are allowed to operate in a country. The current situation, where those criteria are not set until later case law, means that regulators are constantly behind the times. While investigations by regulators tend to be slow to progress, the platform itself can increasingly gain a foothold within a national market.

According to Creemers, Europe would benefit most from a common policy to regulate non-European platforms, which in principle should be country-neutral. The requirements imposed on Chinese platforms should also apply to the data collection of Google and Facebook. After all, these companies are already at a much further stage in obtaining data from European citizens than a platform like TikTok. Creemers emphasizes again, "The questions that need to be asked here are not about China alone."

This article is the first part of a series by Data&Privacyweb on China's position within the privacy domain. In controlling data, is China a country to look up to or down on? In the next article, we take a closer look at China's strict algorithm oversight and its definition of privacy.

See also

Rogier Creemers - 'China's Emerging Data Protection Framework' (https://papers.ssrn.com/sol3/papers.cfm?abstract_id=3964684)

Footnotes

1. https://www.theguardian.com/technology/2019/sep/25/revealed-how-tiktok-censors-videos-that-do-not-please-beijing

2. https://www.tiktok.com/safety/resources/transparency-report?lang=en&appLaunch=

3. https://www.reuters.com/article/us-usa-tiktok-lawsuit/tiktok-accused-in-california-lawsuit-of-sending-user-data-to-china-idUSKBN1Y708Q

4. https://www.wsj.com/articles/tiktok-user-data-what-does-the-app-collect-and-why-are-u-s-authorities-concerned-11594157084?st=bdais6vawyctbgm&reflink=article_copyURL_share

5. https://www.universiteitleiden.nl/nieuws/2018/04/in-china-bepaalt-je-sociale-score-je-leven

6. https://www.politico.eu/article/tiktok-europe-privacy-gdpr-complexity-ties-hands/

7. https://supchina.com/2020/07/16/banning-tiktok-is-a-terrible-idea/

8. https://www.aspi.org.au/report/tiktok-wechat