Answers to Parliamentary questions on report of investigation into Irish privacy watchdog's processing of children's TikTok data

Date November 5, 2021
Subject Answers to Parliamentary Questions on the message 'Irish privacy watchdog investigates how TikTok processes children's data'

1. Are you familiar with the report 'Irish privacy watchdog investigates how TikTok processes children's data'?(1)

Yes.

2. Are you aware of any further (inter)national investigations into the collection, processing and use of children's data by TikTok, in addition to the aforementioned investigation by the Irish Data Protection Commission (DPC) and the investigation by the Dutch Personal Data Authority (AP) in 2020?(2)

&

3. Apart from advertising, what do companies like TikTok use this data for? What insights exist about this? Has there been any recent research on this by European and/or non-European organizations and/or institutions?

&

4. Are the AP and/or the Consumer & Market Authority (ACM) in any way involved in the investigation currently being conducted by the DPC? Are they in contact, possibly in the European context, with the DPC? If not, could this be considered?

The AP informed me that an investigation was launched into TikTok in 2020. On April 9, 2021, the AP fined TikTok €750,000 for violating the privacy of young children. The information given to Dutch users - mostly young children - of TikTok when installing and using the app was in English and therefore not easily understood by everyone. By not offering the privacy statement in Dutch, TikTok did not sufficiently explain how the app collected, processed and further used personal data. TikTok objected to this fine. The 2020 investigation additionally looked at whether the TikTok app was designed and set up in a privacy-friendly way and to what extent parental consent is required when TikTok collects, stores and further uses children's personal data.

However, the AP no longer had jurisdiction to make a decision with respect to that part of the investigation because TikTok moved its headquarters to Dublin during the investigation. Therefore, the AP transferred its investigation findings to the Irish Data Protection Commission (DPC) and formally requested the DPC to continue the investigation and make a decision. In doing so, the AP used the legal possibility to ask fellow AVG supervisors to provide mutual assistance in accordance with Article 61 of the General Data Protection Regulation (GDPR). The investigation into TikTok recently announced by the DPC concerns a follow-up to this request to complete the investigation initiated by the AP. The AP cannot make any announcements about its content. The AP remains closely involved in this investigation as a supervisor that has requested mutual assistance and, in addition, as a so-called concerned supervisor, as described in Article 60 of the AVG.

In addition to this formal involvement, there is also close informal contact between the AP and the DPC on this matter, precisely because of the AP's initiating role with respect to this investigation into TikTok.

Regarding the activities of other European and/or non-European organizations and/or institutions, the AP is kept informed by its fellow regulators of investigations ongoing in the field of data protection. However, the AP cannot comment on possible ongoing investigations at other regulators other than what was previously disclosed through the media.

When asked, the Authority Consumer & Market (ACM) said it has no involvement in the investigation being conducted by the DPC. However, the ACM is involved in the European Consumer Protection Cooperation Network that is currently in dialogue with TikTok. This is not concerned with privacy and data protection, but with compliance with consumer law, such as that reasonable (general) terms and conditions should be used. Given the different role of the ACM vis-à-vis supervisory authorities such as the AP and DPC, the contact mentioned in question 4 is not currently under consideration.

5. What is the status of the implementation of the Van Dijk motion on cyber safety in the use of apps and mobile devices, which, among other things, requests the government to investigate how children could be better protected against the risks and vulnerabilities of (the use of) mobile devices and apps, such as TikTok?(3)

&

6. What other actions and initiatives, in addition to those requested by the aforementioned motion, are underway to increase the cyber security of Dutch app and phone users, especially children?

Regarding the implementation of the aforementioned motion, the Ministry of Economic Affairs and Climate (EZK) has started a tender process to conduct a study. That research, which will be coordinated with my department, will, in accordance with the motion, focus on cyber security of mobile devices and apps with explicit attention to how children could be better protected. It is expected that your Chamber will be informed of the results of this research in mid-2022. Regarding other actions and initiatives that are ongoing in addition to the aforementioned motion, I refer to the actions resulting from the Roadmap Digital Secure Hardware and Software.(4) In the foreseeable future, your Chamber will receive a progress report on these.

7. Do you also intend to follow (the results of) the second investigation launched by the DPC, namely the investigation into the possible sharing of EU users' data with China by TikTok? Do you yourself, based on your own information position, have any indications that this is going on?

I have no such indications. I definitely intend to follow the results of this second investigation. Under Chapter V of the AVG, the transfer of data of (minor) European citizens is only allowed under certain conditions. The main rule here is that data may only be transferred to a third country if an "adequate level of data protection" exists in that country, or safeguards can be provided that still ensure an adequate level of protection. I will note with interest the regulators' conclusions regarding international transfers by TikTok.

Footnotes

(1) NOS, September 15, 2021 (https://nos.nl/artikel/2397885-ierse-privacywaakhond-onderzoekt-hoe-tiktok-gegevens-van-kinderenverwerkt)
(2) Personal Data Authority, May 8, 2020 (https://autoriteitpersoonsgegevens.nl/nl/nieuws/ap-start-onderzoek-naar-tiktok)
(3) Parliamentary Papers II 2020/21, 30821, 148
(4) Parliamentary Papers II, 2017/18, 26643, 535