Answer given by Mr Reynders on behalf of the European Commission
10.3.2021
The Commission is well aware of the concerns and actions being taken and considered around the world on applications such as TikTok. TikTok allows to create and share audio, video and images and may store and access information on the user’s device.
The Commission recalls that the General Data Protection Regulation[1] applies to the processing of personal data by a controller, even if it is not established in the Union, where the processing activities are related to the offering of goods or services to data subjects in the Union. The ePrivacy Directive[2] provides for specific and complementary rules as regards the storage and access to information on the users’ device. Article 5(3) of the ePrivacy Directive requires the users’ consent for the storing or the accessing of information already stored in a user’s terminal equipment (i.e. smartphone or PC), except where such storage or access is necessary for carrying out the transmission of a communication or for the provision of an information society service explicitly requested by the user (i.e. to verify the identity of the user engaged in online transactions). The ePrivacy Directive relies on the definition of consent in the General Data Protection Regulation.
Without prejudice to the Commission’s role as guardian of the Treaties, the monitoring and enforcement of the application of EU data protection law falls within the competence of the national supervisory authorities and courts, which have all necessary powers to investigate whether and which violation might have occurred. The European Data Protection Board decided to establish a taskforce for a more comprehensive overview of TikTok’s processing practices in the EU[3].
- [1] Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation), OJ L 119, 4.5.2016, p. 1‐88.
- [2] Directive 2002/58/EC of the European Parliament and of the Council of 12 July 2002 concerning the processing of personal data and the protection of privacy in the electronic communications sector, OJ L 201, 31.7.2002, p. 37‐47.
- [3] https://edpb.europa.eu/news/news/2020/thirty-first-plenary-session-establishment-taskforce-tiktok-response-meps-use_en