A TikTok spokesperson confirmed this to TechCrunch.
It is not allowed to use personal data stored on (mobile) devices to show personalized advertisements if the user has not given explicit permission for this. The GPDP is also concerned that minors are not adequately protected. After all, the social network cannot rule out the possibility that the content of personalized advertisements may be unsuitable for young users.
TikTok says that collecting personal information to provide personalized advertising is a legitimate interest. Not only the Italian privacy watchdog has great difficulty with this. The Information Commissioner’s Office (ICO) also questions TikTok’s new privacy rules. The British regulator warns that the video platform may only process data that is necessary for stated purposes.
The Data Protection Commission (DPC) confirms that TikTok is temporarily suspending the rollout of the new privacy rules. “Following its engagement with the DPC yesterday, TikTok has now agreed to pause the application of the changes to allow the DPC to conduct its analysis,” a spokesperson for the Irish regulator told TechCrunch.
Legitimate interest or not?
Collecting personal data for commercial purposes: is that a legitimate interest or not? That is a question that has been on the minds of regulators across Europe since the introduction of the GDPR. The Dutch Data Protection Authority uses a strict definition. According to the Dutch privacy watchdog, a commercial interest can never be a legitimate interest.
For that reason, the Royal Dutch Lawn Tennis Association (KNLTB) was fined 525,000 euros in 2020. VoetbalTV, an initiative of the Royal Dutch Football Association (KNVB) and Talpa Networks to broadcast amateur matches live, narrowly escaped a fine from the regulator after legal proceedings.
This was the reason for the European Commission to ask the Dutch Data Protection Authority to take the interpretation of the GDPR less strictly. It would endanger the EU’s internal market and hinder free enterprise. The EU’s executive board pointed out that commercial interests can indeed be a legitimate interests. It cited Google as an example, which would not be able to offer its services without data collection.
Aleid Wolfsen, chairman of the board of the Dutch Data Protection Authority, responded to the letter by saying that national supervisors take an independent position. In a European context, people are busy harmonizing the interpretation of European privacy legislation.
Catch up on more articles here
Follow us on Twitter here