The Data Protection Commission (DPC, for “Data Protection Commission” in French), the Irish gendarme of privacy, announced Tuesday, September 14 to look into the practices of the social network TikTok in terms of personal data.
Two procedures have been launched: the first on possible transfers of personal information of TikTok users to China – TikTok belongs to Bytedance, a company based in this country – and the second on the treatment reserved by the social network of data. minors.
“We have implemented important measures to protect the data of our users and we rely on approved mechanisms for data transferred outside Europe”, reacted the company, relayed by the Financial Times.
On paper, and in the event of serious breaches of European rules on personal data – the General Data Protection Regulation (GDPR) – this double investigation launched by the DPC can lead to fines of up to 4%. of sales.
These two issues – the transfer of data to China and the fate of minors’ data – are both sensitive for the social network, owned by a Chinese company and highly prized by young people.
The question of possible data transfers to China was, for example, at the heart of the standoff between TikTok and the Trump administration, the latter trying to ban the social network from the United States. The Biden administration has abandoned the procedure, although it continues, through the Committee for Foreign Investments in the United States (Cfius), to ensure that Chinese investments do not pose a risk to national security.
Separately, in Italy, TikTok had to delete tens of thousands of accounts after authorities accused it of failing to verify whether users were old enough to process their personal data.
TikTok is also under investigation by the National Commission for Informatics and Liberties (CNIL), in France, as well as by its counterparts in Denmark and the Netherlands.
All the European CNILs announced in spring 2020 the creation of a ” work group ” supposed to address the issue of data on minors and transfers to China, but also “Coordinate potential actions” in the European Union.