TikTok has already received wide criticism in a number of areas, but for the sake of these articles I will only focus on issues related to privacy and the terms of service and not others (for example, discrimination of disabled users via limiting their content reach).
1. Data sharing
“The right to object to processing if we are processing your personal data on the basis of our legitimate interest unless we can demonstrate compelling legitimate grounds which may override your right. If you object to such processing, we ask you to state the grounds of your objection in order for us to examine the processing of your personal data and to balance our legitimate interest in processing and your objection to this processing”
2. Data storage
The standard contractual clauses referred to are a standard set of contractual terms and conditions provided by the European Commission which both the sending and receiving parties sign up to in order to put in place sufficient safeguards on personal data leaving the EEA.
TikTok is owned by ByteDance whose headquarters are located in Beijing, China, unsurprisingly considered a “third country” under the GDPR. It is important to note that in response to global concerns regarding data privacy, TikTok released a statement in October 2019 confirming (for at least the US) that their “data centres are located entirely outside of China”.
Also, I cannot comment upon the sufficiency of the actual terms and conditions put in place between the various ByteDance entities as they are not readily available.
This leads us to the issue of transparency. The above outlines how TikTok has not necessarily been fully transparent with their data transfers and data storage, although they have attempted to provide some clarity as mentioned above.
Section 1 (The types of personal data we use) and section 3 (How we use your personal data) do attempt to clearly set out what personal data is being collected from users as well as how TikTok will process this data. Section 4 (How we share your personal data) attempts to inform users as to what third parties will have access to their data; however, there is no specific listing of which third parties within ByteDance’s corporate group will have such access, which could be seen as an issue when considering ByteDance’s corporate group is defined as “other members, subsidiaries, or affiliates of our corporate group”.
It seems that in response to this kind of criticism, TikTok has updated their Community Guidelines as well as publishing a Transparency Report in December 2019.
4. Tracking Technology
Beyond the conventional trackers (such as Google Analytics) which we can expect to be found on social media platforms, there has been concern over the presence of more controversial device fingerprinting technology, which is essentially a combination of audio and browser tracking to determine which users are watching and/or sharing videos.
Firstly, in order for TikTok to be able to rely on the specific legal ground of “legitimate interest”, they will need to go through a balancing test as set out in Recital 47, GDPR being that they can verify for themselves whether their interest in obscure tracking is not overridden by “the fundamental rights and freedoms of the data subject” and whether it is in line with the user’s reasonable expectations.
In summary, the evidence here does suggest in some areas that there may be cause for concern. The widespread concern seems to be, in large, borne out of negative assumptions surrounding the geographical headquarters of TikTok. Although sometimes this can be a factor worth considering, generally speaking, users should be more concerned with the manner in which their personal data is being processed when using social media platforms. Most social media platforms will have very similar privacy policies, irrespective of their country of origin; so to have particular issue with one solely because of a political/ geographical prejudice, seems to be unfair. However, there are perhaps reasons why users should be concerned with the data processing being done by TikTok, as outlined within this article.