The EDPB, which brings together the EU's data protection regulators, announced it will set up a taskforce to look at TikTik's handling of personal data. The taskforce will look more closely at TikTok’s processing and practices across the EU and coordinate any action by the privacy watchdogs. TikTik said it's working on stepping up its security efforts and increasing transparency about its methods.
The EDPB is responding to a request from the German MEP Moritz Koerner. The board noted that the EU's General Data Protection Regulation still applies to companies like TikTik based outside the EU if they handle personal data of people living in the EU. Furthermore, the board has issued guidelines on the transfer of personal data to third countries, access to personal data by public authorities and processing data of young people.
This is not the first time TikTok has raised concerns among privacy regulators. In May, the Data Protection Authority in the Netherlands opened an investigation into the company's practices and whether it was protecting minors sufficiently. With its parent company Bytedance based in China, TikTok has also come under scrutiny in the US for its security practices.
Transparency centres in the US
In March, the company announced the opening of a Transparency Center in Los Angeles, and it has now said it will have a second Transparency Center in Washington, DC. These centres will give lawmakers and experts the opportunity to "look under the hood of TikTok and assess our security practices and infrastructure", the company said. It will also issue regular transparency reports on how it enforces its own content rules, protects user security and takes down unlawful content.
In addition, TikTik pledged to hire an additional 100 security, data, and privacy protection experts in the US by the end of the year. The company is creating a centralized global security function in the US and also plans to expand its response efforts in Europe, the Middle East and Asia. The key areas of focus will be cyber defense and user-data access assurance, digital crimes, insider threat, cyber-threat intelligence, and risk management, the company said.
