{"id":26297,"date":"2021-09-15T12:20:52","date_gmt":"2021-09-15T12:20:52","guid":{"rendered":"https:\/\/rbsitsoftwaresolution.com\/blog\/ireland-probes-tiktoks-handling-of-kids-data-and-transfers-to-china.html"},"modified":"2021-09-15T12:20:52","modified_gmt":"2021-09-15T12:20:52","slug":"ireland-probes-tiktoks-handling-of-kids-data-and-transfers-to-china","status":"publish","type":"post","link":"https:\/\/www.rbsitsoftwaresolution.in\/blog\/ireland-probes-tiktoks-handling-of-kids-data-and-transfers-to-china.html","title":{"rendered":"Ireland probes TikTok\u2019s handling of kids\u2019 data and transfers to China"},"content":{"rendered":"

Ireland\u2019s Data Protection Commission (DPC) has yet another \u2018Big Tech\u2019 GDPR probe to add to its pile<\/a>: The regulator said yesterday<\/a>\u00a0it has opened two investigations into video sharing platform TikTok.<\/p>\n

The first covers how TikTok handles children\u2019s data, and whether it complies with Europe\u2019s General Data Protection Regulation.<\/p>\n

The DPC also said it will examine TikTok\u2019s transfers of personal data to China, where its parent entity is based \u2014 looking to see if the company meets requirements set out in the regulation covering personal data transfers to third countries.<\/p>\n

TikTok was contacted for comment on the DPC\u2019s investigation.<\/p>\n

A spokesperson told us:<\/p>\n

\n

\u201cThe privacy and safety of the TikTok community, particularly our youngest members, is a top priority. We\u2019ve implemented extensive policies and controls to safeguard user data and rely on approved methods for data being transferred from Europe, such as standard contractual clauses. We intend to fully cooperate with the DPC.\u201d<\/p>\n<\/blockquote>\n

The Irish regulator\u2019s announcement of two \u201cown volition\u201d enquiries follows pressure from other EU data protection authorities and consumers protection groups which have raised concerns about how TikTok handles\u2019 user data generally and children\u2019s information specifically.<\/p>\n

In Italy this January<\/a>, TikTok was ordered to recheck the age of every user in the country after the data protection watchdog instigated an emergency procedure, using GDPR powers, following child safety concerns.<\/p>\n

TikTok went on to comply with the order \u2014 removing more than half a million accounts<\/a> where it could not verify the users were not children.<\/p>\n

This year European consumer protection groups have also raised a number of child safety and privacy concerns about the platform<\/a>. And, in May<\/a>, EU lawmakers said they would review the company\u2019s terms of service.<\/p>\n

\n

TikTok hit with consumer, child safety and privacy complaints in Europe<\/a><\/p>\n<\/blockquote>\n

\n

On children\u2019s data, the GDPR sets limits on how kids\u2019 information can be processed, putting an age cap on the ability of children to consent to their data being used. The age limit varies per EU Member State but there\u2019s a hard cap for kids\u2019 ability to consent at 13 years old (some EU countries set the age limit at 16).<\/p>\n

In response to the announcement of the DPC\u2019s enquiry, TikTok pointed to its use of age gating technology and other strategies it said it uses to detect and remove underage users from its platform.<\/p>\n

It also flagged a number of recent changes<\/a> it\u2019s made around children\u2019s accounts and data \u2014 such as flipping the default settings to make their accounts privacy by default and limiting their exposure to certain features that intentionally encourage interaction with other TikTok users if those users are over 16.<\/p>\n

While on international data transfers it claims to use \u201capproved methods\u201d. However the picture is rather more complicated than TikTok\u2019s statement implies.\u00a0Transfers of Europeans\u2019 data to China are complicated by there being no EU data adequacy agreement in place with China.<\/p>\n

In TikTok\u2019s case, that means, for any personal data transfers to China to be lawful, it needs to have additional \u201cappropriate safeguards\u201d in place to protect the information to the required EU standard.<\/p>\n

When there is no adequacy arrangement in place, data controllers can, potentially, rely on mechanisms like Standard Contractual Clauses (SCCs) or binding corporate rules (BCRs) \u2014 and TikTok\u2019s statement notes it uses SCCs.<\/p>\n

But \u2014 crucially \u2014 personal data transfers out of the EU to third countries have faced significant legal uncertainty and added scrutiny since a landmark ruling by the CJEU last year<\/a> which invalidated a flagship data transfer arrangement between the US and the EU and made it clear that DPAs (such as Ireland\u2019s DPC) have a duty to step in and suspend transfers if they suspect people\u2019s data is flowing to a third country where it might be at risk.<\/p>\n

So while the CJEU did not invalidate mechanisms like SCCs entirely they essentially said all international transfers to third countries must be assessed on a case-by-case basis and, where a DPA has concerns, it must step in and suspend those non-secure data flows.<\/p>\n

The CJEU ruling means just the fact of using a mechanism like SCCs doesn\u2019t mean anything on its own re: the legality of a particular data transfer. It also amps up the pressure on EU agencies like Ireland\u2019s DPC to be pro-active about assessing risky data flows.<\/p>\n

Final guidance put out by the European Data Protection Board<\/a>, earlier this year, provides details on the so-called \u2018special measures\u2019 that a data controller may be able to apply in order to increase the level of protection around their specific transfer so the information can be legally taken to a third country.<\/p>\n

But these steps can include technical measures like strong encryption \u2014 and it\u2019s not clear how a social media company like TikTok would be able to apply such a fix, given how its platform and algorithms are continuously mining users\u2019 data to customize the content they see and in order to keep them engaged with TikTok\u2019s ad platform.<\/p>\n

In another recent development, China has just passed its first data protection law<\/a>.<\/p>\n

But, again, this is unlikely to change much for EU transfers. The Communist Party regime\u2019s ongoing appropriation of personal data, through the application of sweeping digital surveillance laws, means it would be all but impossible for China to meet the EU\u2019s stringent requirements for data adequacy. (And if the US can\u2019t get EU adequacy it would be \u2018interesting\u2019 geopolitical optics, to put it politely, were the coveted status to be granted to China\u2026)<\/p>\n

One factor TikTok can take heart from is that it\u00a0does likely have time on its side when it comes to the\u2019s EU enforcement of its data protection rules.<\/p>\n

The Irish DPC has a huge backlog of cross-border GDPR investigations into a number of tech giants.<\/p>\n

It was only earlier this month<\/a> that Irish regulator finally issued its first decision against a Facebook-owned company \u2014 announcing a $267M fine against WhatsApp for breaching GDPR transparency rules (but only doing so years after the first complaints had been lodged).<\/p>\n

The DPC\u2019s first decision in a cross-border GDPR case pertaining to Big Tech came at the end of last year<\/a> \u2014 when it fined Twitter $550k over a data breach dating back to 2018, the year GDPR technically begun applying.<\/p>\n

The Irish regulator still has scores of undecided cases on its desk \u2014 against tech giants including Apple and Facebook. That means that the new TikTok probes join the back of a much criticized bottleneck. And a decision on these probes isn\u2019t likely for years.<\/p>\n

On children\u2019s data, TikTok may face swifter scrutiny elsewhere in Europe: The UK added some \u2018gold-plaiting\u2019 to its version of the EU GDPR in the area of children\u2019s data \u2014 and, from this month<\/a>, has said it expects platforms meet its recommended standards.<\/p>\n

It has warned that platforms that don\u2019t fully engage with its Age Appropriate Design Code could face penalties under the UK\u2019s GDPR. The UK\u2019s code has been credited with encouraging a number of recent changes by social media platforms over how they handle kids\u2019 data and accounts.<\/p>\n

\n

GDPR\u2019s two-year review flags lack of \u2018vigorous\u2019 enforcement<\/a><\/p>\n<\/blockquote>\n

\n

\n

Ireland must \u2018swiftly\u2019 investigate legality of Facebook-WhatsApp data sharing, says EDPB<\/a><\/p>\n<\/blockquote>\n

\n

\n

WhatsApp faces $267M fine for breaching Europe\u2019s GDPR<\/a><\/p>\n<\/blockquote>\n

\n

\n

TikTok update will change privacy settings and defaults for users under 18<\/a><\/p>\n<\/blockquote>\n

\n

Article source: http:\/\/feedproxy.google.com\/~r\/techcrunch\/social\/~3\/s86L_yzz79Q\/<\/p>","protected":false},"excerpt":{"rendered":"

Ireland\u2019s Data Protection Commission (DPC) has yet another \u2018Big Tech\u2019 GDPR probe to add to its pile: The regulator said yesterday\u00a0it has opened two investigations into video sharing platform TikTok. <\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"jetpack_post_was_ever_published":false,"_jetpack_newsletter_access":"","_jetpack_dont_email_post_to_subs":false,"_jetpack_newsletter_tier_id":0,"_jetpack_memberships_contains_paywalled_content":false,"_jetpack_memberships_contains_paid_content":false,"footnotes":"","jetpack_publicize_message":"","jetpack_publicize_feature_enabled":true,"jetpack_social_post_already_shared":true,"jetpack_social_options":{"image_generator_settings":{"template":"highway","default_image_id":0,"font":"","enabled":false},"version":2}},"categories":[3],"tags":[10,7,14,15,6,12,11],"class_list":["post-26297","post","type-post","status-publish","format-standard","hentry","category-latest-update","tag-computer-news","tag-downloads","tag-microsoft-download-news","tag-networking-updates","tag-technology-update","tag-wordpress-plugin-download","tag-wordpress-theme-download"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t