Last week was the date chosen by TikTok to make the changes to its privacy policy effective. At the beginning of June, this popular social network announced “If you are 18 or over and in the EEA, the UK, or Switzerland, TikTok is making a legal change to how it will use your on-TikTok activity to personalise your ads.” In other words, whether we had accepted ads personalization or not, it would start using our data for that purpose. Was it legal? TikTok shielded itself thus “From 13 July 2022 TikTok will rely on its “legitimate interests” as its legal basis to use on-TikTok activity to personalise the ads of users who are 18 or over”.
Now, according to TechCrunch, TikTok has decided to stop this change due to pressure from some European data protection authorities. “At TikTok, we strive to build a personalized experience for our community, and at the same time we are committed to respecting the privacy of our users, being transparent about our privacy practices, and operating in compliance with all relevant regulations. While our evaluation of the Italian Data Protection Agency’s recent notice is still ongoing, we cannot comment further” a TikTok spokesperson said.
This decision comes after the Italian data protection authority (Guarante per la protezione dei dati personali) made a formal warning to TikTok last week in which it warned that this modification of its privacy policy could be a violation of European regulations on privacy:
“(This would be) in conflict with the current regulatory framework, at least with regard to the information stored in users’ devices, and would entail all the relevant consequences also in terms of corrective measures and fines”
Although its Irish counterpart, before which TikTok is accountable since there where its headquarters are located, affirms that this decision is due to the conversations held on its part.
Meanwhile, the Spanish Data Protection Agency (AEPD) made a similar announcement: “The AEPD ex officio initiates preliminary investigation actions against TikTok due to the announced change in the way in which this company justifies the processing of personal information to display advertising”
These European authorities appeal to article 21 of the GDPR, which includes the right to oppose the collection of information and the elaboration of profiles:
“The data subject shall have the right to object, on grounds relating to his or her particular situation, at any time to processing of personal data concerning him or her which is based on point (e) or (f) of Article 6(1), including profiling based on those provisions. The controller shall no longer process the personal data unless the controller demonstrates compelling legitimate grounds for the processing which override the interests, rights and freedoms of the data subject or for the establishment, exercise or defence of legal claims.”
Art. 21.1, GDPR
“Where the data subject objects to processing for direct marketing purposes, the personal data shall no longer be processed for such purposes.”
Art. 21.3, GDPR
Therefore, this means unless TikTok provides users with the option to oppose this new privacy policy, it would be in breach of current regulations.
This decision made by TikTok shows that apart from fines and sanctions, GDPR enforcement has an effective role in stopping implementation of such bad practices, thus safeguarding and guaranteeing protection to users and consumers within the EU.
