TikTok makes clear European data can be accessed by China-based employees

By CNN

Published November 2, 2022 12:03 PM

CNN

By Brian Fung, CNN

TikTok updated its privacy policies for European users on Tuesday, adding explicit disclosures that personal data from the app may be viewed by employees in China.

The update aligns with what TikTok executives have said publicly. But the addition reflects the intense scrutiny TikTok has faced over its international data flows.

The announcement, which TikTok said was aimed at providing greater transparency, applies to users in the European Economic Area, the UK and Switzerland — not the United States, though TikTok said it does store European users’ data in the US and in Singapore.

In addition to China, TikTok data may be handled by employees in countries including Brazil, Canada, Israel, Japan, Malaysia, the Philippines, Singapore, South Korea and the US, the company said. Access to European user data, TikTok added, is allowed for “certain employees within our corporate group” and is “based on a demonstrated need to do their job.”

TikTok also said those employees’ access is governed by “robust security controls” and occurs “by way of methods that are recognized under the GDPR,” the European Union’s signature privacy law.

“In order to operate a global platform designed for sharing joyful content, we rely on a global workforce to ensure that our community’s TikTok experience is consistent, enjoyable and safe,” Elaine Fox, TikTok’s head of privacy in Europe, wrote in the company’s announcement.

US policymakers have grown increasingly vocal about concerns the Chinese government could pressure TikTok or its parent company, ByteDance, to hand over users’ personal data under the country’s national security laws.

Amid those fears, TikTok has spent months negotiating with the federal government on a possible national security agreement that would allow it to continue operating in the United States. TikTok has also migrated US user data from proprietary servers in the US and Singapore to cloud-based servers hosted by Oracle.

But that has not dampened criticism that user data could still be accessed by China-based individuals subject to that country’s security laws, a practice TikTok would not commit to stopping and further emphasized would continue with Tuesday’s European policy update.