Data security fears have made governments worry over use of the TikTok app
Daragh O’Brien of Castlebridge
TikTok has over one billion monthly active users
TikTok CEO Shou Zi Chew arrives to testify before the House Energy and Commerce Committee hearing titled TikTok: How Congress Can Safeguard American Data Privacy And Protect Children From Online Harms, in Rayburn Building on Thursday, March 23, 2023. (Tom Williams/CQ-Roll Call, Inc via Getty Images)
/
Data security fears have made governments worry over use of the TikTok app
Jonathan Keane
Last summer, when Micheál Martin stood with TikTok chief executive Shou Zi Chew at a photo op to announce 1,000 new jobs at the company’s Irish offices, there was little chance he could have expected what was coming next for the global tech company.
TikTok has established a sizeable presence in Ireland in just a few years, with 3,000 jobs and one data centre operating here at the moment, plus another data centre on the way.
All the while, it has found itself on the global stage caught in the middle of a fraught geopolitical tussle between China and the US.
It’s a tussle that Ireland is getting increasingly wrapped up in.
The social media sensation, which is owned by Chinese firm ByteDance, is the subject of fierce criticism in the US – where lawmakers are pushing for either a ban on the app, or its compulsory sale to a US buyer. There is also growing suspicion among European nations.
‘We shouldn’t just be looking at one specific app as part of a moral panic’
At the heart of the debate are TikTok’s Chinese origins, its potential links to the Chinese government – and what that means for the data the company holds on Europeans and Americans.
While the Irish Government has opened the door to the company’s significant investments in the country, the EU is taking a more critical tone.
In February, the European Commission ordered the TikTok app be banned from staff devices, in order to “protect data and increase cybersecurity”.
Daragh O’Brien, managing director of data and governance consultancy Castlebridge, said that governments should be asking these kinds of questions about apps on official phones – but the focus on just one company is misplaced.
“We should step back and ask ourselves what data are we actually sharing with what apps, and why – and ultimately who might have access to that data. We shouldn’t just be looking at one specific app as part of a moral panic,” O’Brien said.
But the European Commission’s decision added fuel to the fire around TikTok.
Irish MEP Colm Markey of Fine Gael followed that move with a call on the Government here to do the same.
Markey told the Sunday Independent that he has “serious concerns” about the data collected by TikTok and whether it is sent to China.
The MEP said his concerns are centred on TikTok being installed on government devices, and his intentions are “not about banning it for ordinary people”.
Read More
The Department of Justice said it follows the guidance of the National Cyber Security Centre on the security of government devices, and that those assessments “are kept under continuous review”.
TikTok has regularly pushed back on the claims that it sends any data to China and the company is currently establishing a framework for storing European user data within Europe.
A spokesman for TikTok said the company regularly engages with governments to discuss its data protection approaches.
The current debate has echoes of the furore that sprung up around Huawei, the Chinese telecommunications equipment maker.
For many years now, Huawei has been on the receiving end of a torrent of US-led allegations that its technology – which is used to power 5G mobile phone networks – could be used to spy on Western countries, at the behest of the Chinese government.
It is a charge that Huawei has denied vigorously.
But the allegations have had a tangible effect on the company. It remains on a US trade blacklist, and the UK has ordered its telecoms to strip all Huawei tech from their networks.
In March, TikTok unveiled new measures in the way it stores data in Europe
The company recently reported a 69pc year-on-year decline in profits after all the curbs on its operations.
This is the fate that TikTok is seeking to avoid, by convincing lawmakers and users alike that it stores all its data at arm’s length from its Chinese owners.
It is amid these efforts where Ireland comes into focus.
TikTok unveiled a slew of new measures in March, outlining the way it handles and stores data in Europe.
Dubbed ‘Project Clover’, the initiative focuses on “creating a secure enclave” for European data.
TikTok already has one data centre in Dublin and plans to open a second one here. Another data centre is planned for Norway.
The company said that it has begun moving all European user data – currently held in sites in the US and Singapore – to these data centres, and will complete that migration by next year.
“We’re always happy to engage with governments and institutions to explain the work we’re doing to further protect our European community and their data,” a spokesman for TikTok said.
“Our comprehensive plan includes storing European TikTok user data in our local data centres, including two in Ireland; further tightening data access controls; and working with a third-party security company to provide independent oversight of our approach.”
TikTok CEO Shou Zi Chew arrives to testify before the House Energy and Commerce Committee hearing titled TikTok: How Congress Can Safeguard American Data Privacy And Protect Children From Online Harms, in Rayburn Building on Thursday, March 23, 2023. (Tom Williams/CQ-Roll Call, Inc via Getty Images)
/
TikTok CEO Shou Zi Chew arrives to testify before the House Energy and Commerce Committee hearing titled TikTok: How Congress Can Safeguard American Data Privacy And Protect Children From Online Harms, in Rayburn Building on Thursday, March 23, 2023. (Tom Williams/CQ-Roll Call, Inc via Getty Images)
As part of the project, TikTok will add new data access controls to limit and restrict the ways that TikTok staff can access the data it holds.
According to the company, these data centres and data control efforts will amount to a total annual investment of €1.2bn.
By running two data centres in Ireland, TikTok joins a roster of large tech companies, including Meta and Amazon, that are now storing data on Irish soil.
TikTok is going to great lengths to assure lawmakers and regulatory watchdogs that all its European data will be staying in Europe and crucially not going to China.
Possible data transfers to China by TikTok are currently the subject to an investigation by Ireland’s Data Protection Commission.
The watchdog, which oversees several major tech firms in their compliance with the EU’s GDPR data rules, has a second, separate probe that is examining TikTok’s handling of children’s data.
Meanwhile, TikTok’s representatives have been getting out front and centre to stave off any talk of bans or restrictions.
In March, TikTok’s chief executive Shou Zi Chew sat before a US congressional hearing for a testy exchange with lawmakers over the app’s data collection and its links to China.
‘The EU already has regulatory methods of holding TikTok accountable for privacy issues’
Chew was eager to downplay those links, pointing to the company’s Singapore and Los Angeles headquarters and its data centre initiative in the US that would keep Americans’ data within US borders – much as its Project Clover does in Europe.
While the congressional hearing attracted much attention and analysis, it did not pave the ground to provide the clear next step for TikTok and its relationship with Washington DC.
TikTok is a unique animal in the US political arena, in that it has proved an unusually bipartisan issue.
In Europe, there is not as much unity on that issue and no talk of an outright ban of the app, instead focusing on government work devices.
After the European Commission’s decision to ban it on work devices, some countries have followed suit, such as Denmark – but not every nation is falling in line with the European Commission.
Poland’s ruling party, PiS, publicly questioned the Commission’s ban and asked it to present the technical details for justifying it. The party said it would continue to use TikTok, including for campaigning.
Sean O’Brien, a visiting lecturer in cybersecurity at Yale Law School in the US, is doubtful that Europe will make threats of outright bans such as have been lobbed about in the US.
‘Much more broadly, the US and the European alliance is very important’
“The EU could choose to ban TikTok as well, citing similar concerns about data privacy and nebulous claims about security. That would be a mistake,” said O’Brien.
“The EU already has regulatory methods of holding TikTok accountable for privacy issues – and those methods are much preferable to heavy-handed censorship of any app or website.”
O’Brien is critical of the position taken by the US and other Western governments on TikTok, referring to the similarly large troves of data collected by US companies such as Google and Meta.
“The singling out of TikTok because of a fear of Chinese intelligence is not only disingenuous, it is hypocritical in the extreme,” he said.
“The US is the home of the most extensive corporate surveillance regimes, as well as the most powerful and capable government intelligence agencies.”
On the other hand, Jonathan DT Ward – a US-China relations expert at Washington think-tank Atlas Organization – is in favour of a US ban.
However he does not see the different approaches to TikTok causing a rift between the US and Europe in the broader China relations discussion.
“We can understand and agree upon the nature of the problem,” said Ward. “I think eventually we can probably get to similar understanding of that TikTok issue – but much more broadly, the US and the European alliance is very important.
"I think we’re going to be in a process of finding common ground on different issues.”