TikTok: European user data can be accessed by staff in China

According to an update to TikTok’s privacy policy published earlier this week, data for users in the European Union, United Kingdom and Switzerland can be accessed by staff in China, among other countries. In Wednesday’s update, the social media platform said staff access is given “based on a demonstrated need to do their job,” and is “subject to a series of robust security controls and approval protocol.” Other countries where TikTok staff have access to European user data include:

• Brazil
• Canada
• Israel
• Malaysia
• Philippines
• Singapore
• South Korea
• The United States

“Building on our ongoing work to advance our data security around the world, we are continuing to make progress in our approach to Data Governance in Europe,” Elaine Fox, TikTok’s head of privacy for Europe, said Wednesday. “Our efforts are centered on limiting the number of employees with access to European user data, minimizing data flows outside of the region, and storing European user data locally.”

The European privacy policy update comes as TikTok is under scrutiny from authorities around the world over concerns data could be passed to China’s government. Earlier this week, FCC Commissioner Brendan Carr called on the Council on Foreign Investment in the U.S. to ban the social media app.

The U.K. Parliament closed down its TikTok account in August after MPs raised concerns. The same month, the chief administrative officer (CAO) for the House of Representatives recommended members not download or use TikTok due to security concerns.

“The ‘TikTok’ mobile application has been deemed by the CAO Office of CyberSecurity to be a high-risk to users due to its lack of transparency in how it protects customer data, its requirement of excessive permissions, and the potential security risks involved with its use.” the CAO said in an advisory. “Additionally, we believe the user base should be aware that this application is known to store users’ Data Location, Photos, and other Personally Identifiable Information (PII) in servers located in China and potentially mined for commercial and private purposes.”

BBC News contributed to this report.