The Irish Data Protection Commission (DPC) recently levied a hefty fine of €345 million on social media titan TikTok for severe violations of data protection regulations, as highlighted in a JURIST News report. This development comes in light of growing perceptions about the platform’s handling of personal data, especially in relation to underage users.
The investigation into the company’s data practices, initiated in September 2021, scrutinized TikTok’s adherence to the General Data Protection Regulation (GDPR). This regulation stipulates robust standards for data privacy and protection across the European Union.
The probe primarily focused on how TikTok processed children’s data from 31 July to 31 Dec 2020. Concerning areas like the platform settings for child users, age verification, and transparency information for children drew particular attention. The DPC discovered that minor accounts were automatically set as public, thereby exposing children to potential privacy and safety pitfalls.
Moreover, the Family-Pairing feature, designed to enable parents to set controls on their child’s TikTok account, inadvertently allowed unverified users to connect with child accounts. Also, TikTok was found lacking in providing sufficient transparency information to its young viewers.
Following the initial decision, the Italian and Berlin data protection authorities presented justified objections, with further feedback from other bodies. As a result, the matter was escalated to the European Data Protection Board (EDPB) for a final decision. The EDPB directed that the DPC should, in its final ruling, include a fresh infringement finding concerning the effects of TikTok’s influence on users’ privacy choices and impose an elevated penalty.
EDPB Chair, Anu Talus, emphasized the need for social media platforms to present privacy choices fairly and transparently, particularly when dealing with children, condemning deceptive or manipulative elements.
In a responsive move, TikTok confirmed its obligation to data privacy and protection. It acknowledged the importance of user privacy and outlined measures taken to augment protections, especially for younger users. The platform intends to work closely with the DPC to address the identified issues and ensure compliance with data protection statutes.