TikTok vs. Europe: Could EU data privacy law slay the "data dragon"?
London — The social media platform TikTok has been in American lawmakers' crosshairs for months, and the sentiment is spreading across the Atlantic. European legislators are voicing increasing concern about the Chinese-owned app's data policies and its influence on young people, and Europe's regulators may have more potent legal weapons at their disposal to challenge the company.
French President Emmanuel Macron has been the highest-profile European leader to criticize the social platform whose parent company ByteDance is based in China. At an event on mental health in December, Macron called TikTok "the most disruptive" social media outlet for young people, warning that it was "deceptively innocent" and addictive.
"We remain vigilant in any situation that would lead to a compromise in the protection of our citizens' data," Jean-Noel Barrot, France's Minister for Digital Transition and Telecommunications, told CBS News, adding that he meets "on a regular basis" with TikTok managers in France to discuss "data protection issues and content moderation and protection of minors."
German Member of the European Parliament Moritz Körner has been pushing EU regulators to get tough on TikTok for years.
"From a geopolitical perspective, the EU's inactivity towards TikTok has been naïve," he told CBS News. "The data dragon TikTok must be placed under the surveillance of the European authorities."
Körner said the EU has been slow to implement oversight of the platform, arguing that Tiktok "poses several unacceptable risks" for users, including "data access by Chinese authorities, censorship and the tracking of journalists."
Maximilian Funke-Kaiser, a spokesman for Germany's liberal FDP party, told CBS News that TikTok has been guilty of "systematic data misuse" and said that security concerns about the app are "justified."
"To be clear: If you do business here and earn a lot of money with it, you must also comply with applicable law. Otherwise, there is no room for the company here," he said.
Funke-Kaiser said steps taken by the U.S. government to ban the platform for employee use were something that should be replicated in Germany.
"I consider the ban on TikTok on working equipment of officials of the U.S. government to be appropriate in view of the data protection and security risks," he said.
Responding to the concerns voiced by European officials, a TikTok spokesperson told CBS News in an email that the company had responded to the ban in the U.S. by putting together "a comprehensive package of measures with layers of government and independent oversight to ensure that there are no backdoors into TikTok that could be used to manipulate the platform."
"These measures go beyond what any peer company is doing today on security," the TikTok spokesperson said.
Legal challenges
While the United States has taken the step of banning TikTok on government devices in the name of national security, wide-ranging EU data protection laws already on the books could become an even bigger headache for TikTok executives.
TikTok is currently the subject of two investigations by Ireland's data protection regulator over transfers of user data to China that may breach the country's laws, as well as possible violations of children's privacy.
The company may also come under a direct audit and face fines of up to 6% of the platform's annual revenue under the EU's new Digital Services Act, if it's found to have failed to comply with that law.
It was in this context that TikTok CEO Shou Zi Chew flew last week to Brussels. The head of the social media outlet was on a charm offensive, trying to assuage concerns, but high-level European policy chiefs sent him home with stark warnings.
"I count on TikTok to fully execute its commitments to go the extra mile in respecting EU law and regaining trust of European regulators. There cannot be any doubt that data of users in Europe are safe and not exposed to illegal access from third-country authorities," European Commission Vice-President for Values and Transparency Věra Jourová told media after the meeting.
A TikTok spokesperson told CBS News that the company has a "clear plan that we're already implementing to reassure our community that they can trust us with their data... This includes storing European user data in our data center operations in Ireland, starting this year; further reducing employee access to data; and minimizing data flows outside of Europe."
"Europe must finally wake up"
Tiktok's relationship with the Chinese government is complex. The platform's parent company ByteDance is based in Beijing, and while the company has denied sharing data with Chinese authorities, TikTok admitted in a policy update last November that Chinese employees could be granted "remote access" to European user data.
That admission sparked fears that the Chinese government could legally force ByteDance to hand over any user data to which the company has access. Given that China's ruling Communist Party has complete control over all business conducted on the country's soil — with no checks or balances on that power, it's not a far-fetched concern.
ByteDance collects a sizable amount of data through TikTok and other digital properties. According to the company's own privacy policy, TikTok collects the names of users, passwords, phone numbers, private messages on the app, the mobile networks used by its users, their contacts, satellite location information, and payment details such as credit card info.
And TikTok is growing fast. As of June 2022, there were 227.81 million users in Europe. To put that in context, there were fewer than 100 million Twitter users in Europe as of 2022, according to DataReportal.
Körner believes it's high time for European lawmakers to reign in the video sharing app by simply enforcing existing laws.
"TikTok's success is the result of a European policy failure," he told CBS News. "Europe must finally wake up… If TikTok refuses to abide by EU laws, it should be banned."