TikTok is a fairly new platform that is widely used and particularly popular among children and young people. Through this platform, users can create and upload short personalised videos or, if a career as a famous TikTokker does not sound like a dream, simply scroll for hours.
The Dutch Data Protection Authority (Authoriteit Persoonsgegevens) announced earlier this year that it had started an investigation into the processing of personal data by TikTok, with a particular focus on TikTok’s clarification of the data it processes.[1]
Under the General Data Protection Regulation (GDPR), general standards of care must be observed when processing personal data. In any case, the data controller (in this case TikTok) has an obligation to provide information.
The obligation to inform means that the data controller must inform the data subject about its data processing in a transparent and comprehensible manner which information is easily accessible and is communicated in clear and simple language. The data subject must be able to follow the way in which its data is processed. The data controller must disclose information regarding – among other things – the purpose for which the data is collected, on what legal grounds the collection takes place and how the data subject can verify his/her data. The foregoing is almost always laid down by the company, or in this case the platform, in its privacy policy.
When it concerns the processing of personal data of minors (children), obviously more attention should be paid to the way in which the information is communicated. The children must of course be able to understand this explanation.
As a result of the investigation, the Dutch Data Protection Authority (Autoriteit Persoonsgegevens) found that it was not clear to users how TikTok was processing personal data. Especially the non-English speaking children could not understand the English privacy policy. For this reason, the Dutch Data Protection Authority imposed a fine of € 750,000 on TikTok. This fine seems justified; TikTok will have to take more measures to guarantee the privacy of children. TikTok has already filed an objection, so to be continued!
Do you have questions about the GDPR or other privacy related questions? Please contact Michelle Seel (michelle@thelegalgroup.nl) or Helen Maatjes (helen@thelegalgroup.nl).
[1] Press realease AP, https://autoriteitpersoonsgegevens.nl/nl/nieuws/ap-start-onderzoek-naar-tiktok.