AP warns users: TikTok continues to send personal data to China

TikTok continues to send user data to China and other countries for the time being. In doing so, the company is going against a joint decision by European privacy regulators, who have determined that the transfer of data is unlawful. Since yesterday, TikTok has been showing a warning to users about what the company does with the data. The Autoriteit Persoonsgegevens (AP), the Dutch data protection authority, believes it is important that people understand what this means for their privacy.

The AP is calling on users and organisations to carefully consider whether they wish to continue using TikTok and other services that transfer personal data to countries outside the EU. The AP indicates that this international transfer is a broader social issue and is also investigating the risks associated with other online services.

What does the TikTok notification mean?

TikTok has appealed against the decision of the European supervisory authorities, determining that the transfer of data to China by TikTok breaches the GDPR,and will continue to transfer personal data in the meantime. Users are shown a notification about what TikTok does with their personal data, which states:

• TikTok continues to transfer personal data of European users to countries outside the EU, including China.
• The Irish data protection authority (DPC) previously ruled - in the context of the European Data Protection Board (EDPB) - that this transfer violates the General Data Protection Regulation (GDPR)

  The General Data Protection Regulation (GDPR), together with the Law Enforcement Directive (LED), is the main privacy legislation, applying throughout the EEA.

  .
• The Irish court temporarily suspended the imposed measures, but the ruling of the supervisory authorities stands.

"It's good that the Irish court is requiring TikTok to better inform its users", says Monique Verdier, Deputy Chair of the AP. "TikTok collects and uses a lot of personal data, including clicking behaviour, location data, contact information and sometimes financial data as well. Especially minors are often insufficiently aware of the data collection and the risks involved. In Europe, clear rules give people ownership of their personal data; outside the EU, such as in China, those rules are different. This means that users often have little control over what happens to their data. We believe that people and organisations should seriously consider whether they find this acceptable."

Call to TikTok users

The AP gives the following advice to anyone who uses TikTok:

• Read TikTok's notification and privacy statement carefully.
• Check the privacy settings: what type of access does TikTok have to your camera, microphone, contacts or location?
• Decide whether you want to continue using TikTok under these circumstances. If not, you can (temporarily) delete the app or deactivate your account.
• Be cautious about what you share through the app. Do not share sensitive information.

In addition, the AP provides specific advice to organisations that use TikTok:

• Identify the risks, for example through a data protection impact assessment (DPIA). Take into account that regulators have assessed TikTok's transfer of data as unlawful.
• Determine whether it is responsible to continue using TikTok. Public and semi-public organisations set an example in this respect. Governments that use the platform give the impression that this can be done without any problems.
• Have you decided to continue using TikTok? Be clear and transparent about this with your target groups and about the risks it entails for them.