State Secretary Van Huffelen (Kingdom Relations and Digitalization) answers questions on the message 'Chinese TikTok employees gain access to data European users'. Lower House members Dekker-Abdulaziz (D66), Bouchallikh (GroenLinks), Kathmann (PvdA), Azarkan (DENK), Ceder (ChristenUnie), Van Weerdenburg (PVV), Koekkoek (Volt), Bontenbal (CDA), Leijten (SP), Rajkowski (VVD) and Eerdmans (JA21) asked the questions.
Question 1 Are you familiar with the report 'Chinese TikTok employees gain access to data European users'?
Answer to question 1
Yes, I am familiar with that.
Question 2 Can you estimate how many Dutch people currently use TikTok? How many of these users are children?
Answer to question 2
As of January 2022, there were approximately three million Dutch users of TikTok (1). The minimum age for using TikTok, according to TikTok's policy, is 13. TikTok was asked how many of its users in the Netherlands are minors. In doing so, TikTok has indicated that they cannot disclose this information, as it is company-sensitive information for TikTok. It is difficult to determine with certainty how many of the Dutch users are minors. A factor here is that the accuracy of the age given by users is not verified by TikTok. Minors can therefore pretend to be adults. Research by the British (telecom) regulator Office of Communications (Ofcom) showed last month that one in three British children has an adult social media account (2). By all accounts, there are also children in the Netherlands who have adult accounts.
Question 3 Which employees have access to the information collected? Is it true that some of TikTok's employees have dual roles with the Chinese Communist Party and thus the Chinese government will have access to all this personal information?
Answer to Question 3 At this time, we do not know which TikTok employees have access to which data. TikTok has been approached to provide more information about this, but TikTok has indicated that they are unable to provide an answer. Of course, I would find it absolutely unacceptable if personal data were transferred to the Chinese government in violation of the General Data Protection Regulation (AVG). The conditions under which personal data can be transferred from the EU to third countries are set out in the AVG. Transfer of personal data to third countries, including China, must take place
according to Chapter V of the AVG. Whether TikTok's transfer is unlawful is not for me or this administration to determine, but for the Personal Data Authority (AP) or its counterpart in the member state where TikTok has its headquarters. Currently, the Irish regulator (DPC), as the leading authority in the EU, is investigating how TikTok processes personal data. This involves two investigations. The first investigation focuses on the processing of personal data of underage users in the context of the platform settings of the TikTok platform relating to accounts of users under 18 and age verification measures. The investigation also examines whether TikTok has complied with the transparency obligations of the AVG in the context of processing personal data of users under 18. The second investigation focuses on TikTok's transfers of personal data to third countries including China and its compliance with the requirements of the AVG for these transfers. The DPC launched both investigations in September 2021. The DPC submitted its draft decision in the first investigation to regulators - including the AP - in the other member states in early September 2022. This is part of the process under Article 60 of the AVG. For the second investigation where transfers to third countries are concerned, the Law Minister has asked the AP to ask her Irish counterpart about the status of this investigation.
Question 4 Could you explain what kind of data is involved? Does this involve personal data, personal preferences or psychological profiles?
Answer to question 4 It is not known to me which data is processed in which way and which TikTok employees have access to which data. TikTok states in its privacy policy what data is collected. In its policy, TikTok writes that data is collected under three categories: (1) information provided by the user, (2) information collected automatically, and (3) information from other sources. These include profile information, user content and information from direct messages from users, as well as user location data, technical data related to the user's device, user information and cookies. Also, in cases, information about users is shared with TikTok by advertisers on TikTok.(3)
Question 5 Does the minister consider it desirable for the Chinese government to have access to this type of information, especially also about children?
Answer to question 5
As I wrote in response to question 3, I would find it absolutely unacceptable for personal data to be transferred to the Chinese government in violation of the AVG. I will soon be engaging with TikTok as part of a series of conversations with several major tech companies. In that conversation, the principles mentioned above will be brought to TikTok's attention.
Question 6 Will the minister immediately call on TikTok not to share data of European users stored within the EU with China?
Answer to question 6
As reported in response to Question 3, transfers of personal data in third countries can be lawful, provided the conditions of Chapter V of the AVG are met. On June 18, 2021, the European Data Protection Board (EDPB) adopted guidelines that aim to provide guidance to companies and organizations when assessing which additional measures they can take when processing - including transfer - personal data with third countries in order to comply with the conditions of the AVG. I find it unacceptable if data of Dutch citizens is unlawfully shared with the Chinese government. I will soon be speaking with TikTok as part of a series of discussions with several large tech companies. The principles mentioned above will be brought to TikTok's attention, partly in response to the reporting on this matter. It remains for the independent regulator to investigate and enforce the legality of data processing.
Question 7 What steps does the minister consider necessary towards TikTok in the Netherlands and the EU as long as personal data ends up in the hands of the Chinese government?
Answer to question 7
It is first and foremost for the independent regulator to investigate the lawfulness of the processing of personal data, and then to take action against it. In the system of the AVG, no powers are granted to the Cabinet. In doing so, I would like to note that within the AVG, the supervisor has a wide range of powers to take corrective action should it deem it necessary. For example, the supervisor can warn, reprimand or order the controller or processor to comply with a data subject's request for the exercise of his or her rights. A fine may also be imposed, and the supervisor may also impose a temporary or permanent ban on processing or order the suspension of data flows to a third-country recipient. As mentioned in the answer to question 3, the DPC is currently conducting investigations into whether personal data transfers to third countries - including China - comply with the AVG requirements for such transfers. In addition, last year the AP imposed a €750,000 fine on TikTok for violating the privacy of young children. The information provided to Dutch users of TikTok when installing and using the app was in English and therefore not easily understood by young children. By not offering the privacy statement in Dutch, TikTok did not sufficiently explain how the app collects, processes and uses personal data. During the AP's investigation, TikTok relocated to Ireland and from then on the AP was only competent to adjudicate TikTok's privacy statement, as the violation had ended. Regarding the deployment of TikTok for government communications, I can inform you that since September the Department of Public and Communication (DPC) of the Ministry of General Affairs (AZ) has been advising to suspend the deployment of TikTok for the central government due to data protection concerns.
Question 8 What steps are currently being taken within the EU to clarify and expand the legal frameworks regarding adequate security of data transfers worldwide to prevent foreign intelligence agencies from accessing personal data of European users?
Answer to question 8
Within the EU, provisions of the AVG regarding adequate security of data transfers have been clarified through guidelines issued by the EDPB (see also answer to question 6) (4). These guidelines aim to provide guidance to organizations on security measures when processing - including transfer - personal data with third countries in order to comply with the conditions of the AVG. For example, these guidelines provide practical examples of how security measures can be taken. For example, these guidelines state how data can be transferred pseudonymized and how data can be encrypted to protect it from access by government authorities of the third country.
Question 9 What steps are you taking towards the European Commission to draw attention to this and take action on it?
Answer to question 9
See the answer to question 10.
Question 10
How are you implementing the agreement in the coalition agreement that we protect children by giving them the right not to be tracked and not to be data profiled?
Answer to question 10
Regarding the right of children not to be tracked and not to receive a data profile, European legislation is relevant. In data protection law, children have the right to specific protection, especially when their personal data is used for marketing purposes or for personality or user profiling (recital 38 AVG). This protection will be strengthened by the Digital Services Act (DSA), which comes into force in 2024. It will then be illegal for very large platforms such as TikTok to collect data from minors for profiling for marketing purposes The European Commission announced in the updated Better Internet For Kids (BIK+) strategy that it will publish an EU code of conduct for age-appropriate design. This code of conduct should help ensure compliance with the obligations laid down in the DSA and AVG to prevent children from being tracked and data profiled. We are closely involved in these European developments and are committed to further strengthening the protection of children in the digital world.
Question 11 Can you answer these questions separately before the Digital Affairs budget debate on November 14, 2022?
Answer to question 11 Yes.
National Social Media Survey 2022; Newcom Research & consultancy, Jan. 29, 2022
https://www.ofcom.org.uk/news-centre/2022/a-third-of-children-have-false-social-mediaage-of-18
https://www.tiktok.com/legal/page/eea/privacy-policy/NL
4 https://edpb.europa.eu/system/files/2022- 04/edpb_recommendations_202001vo.2.0_supplementarymeasurementstransferstools_en.pdf
