A cross-party group of MPs and peers have asked the information commissioner to investigate whether the Chinese-owned TikTok’s handling of personal information is in breach of UK law.
The letter from the Inter-Parliamentary Alliance on China (IPAC) argues that TikTok cannot be compliant with data protection rules – and comes just hours after the UK announced a ban on the popular video-sharing app appearing on ministers’ and officials’ government-owned phones.
IPAC believes TikTok could ultimately be forced to shut operations in the UK if it cannot find a way of complying, amid escalating western pressure on the company because of its Chinese ownership and the security of the data of its millions of users.
But TikTok said it is a victim of “fundamental misconceptions” which it earlier complained were “driven by wider geopolitics” in which ordinary people play no part – and that it had begun work on a European data security plan to head off the legal concern.
Earlier on Thursday, Oliver Dowden, the Cabinet Office minister, said that following a security review by UK intelligence officials, the app would be banned from the government phones of ministers, advisers and civil servants “with immediate effect”.
Dowden said TikTok required users to give permission for the app to access data stored on the device, which is then collected and stored by the company – and can be accessed from China.
Allowing such permissions gives TikTok access to a range of data, including contacts, user content and geolocation data. Dowden said this justified the ban because there was “a specific risk with government devices”.
Britain joined the US, the European Commission, Canada and Belgium in banning TikTok on government devices in recent weeks amid a further deterioration of relations with China. A UK foreign policy review earlier this week described Beijing as posing an “epoch-defining challenge” to the west.
But China accused the UK of abusing the concept of national security. “The decision was made by the UK side based on its political motive rather than facts,” an embassy spokesperson said, adding that it “undermines the confidence of the international community in the UK’s business environment” and would hurt British interests.
Dowden’s announcement marks a sharp U-turn from the UK’s previous position and also came a few hours after TikTok said its owner, ByteDance, had been told by Washington to sell the app or face a possible ban in the country.
The fresh complaint from the MPs and peers was made by a group including Labour, Conservative and Lib Dems, and is intended to ask the Chinese-owned company wider questions potentially affecting all of its users.
One of the MPs, Carolyn Harris, representing Labour, also said she was “deleting her TikTok account today” and “encouraging others to do the same”.
Harris, whose videos regularly notch up tens of thousands of views, said she had believed TikTok was a good way of communicating about her chosen campaign issues, including menopause awareness.
But the MP added: “I don’t want my constituents being exposed to the Chinese Communist party’s data harvesting. So I believe MPs have a responsibility to set an example”.
At the heart of the complaint is TikTok’s acknowledgment that user data can in some circumstances be accessed from China, and so outside UK safeguards. “It is my understanding that TikTok cannot implement appropriate safeguards to protect personal data that is transferred outside of the UK and EEA region,” wrote Lord Bethell, a Conservative peer, who is another complainant.
Other members of the IPAC seeking answers from the information commissioner include the Conservatives Iain Duncan Smith and Tim Loughton, the Lib Dems Wera Hobhouse and Alistair Carmichael, and Labour’s Sarah Champion.
Particular concern centres on a 2017 national security law in China, which requires organisations and citizens to “support, assist and cooperate with the state intelligence work”. It has been cited in the past to justify complete bans on kit made by Huawei, also a Chinese company, in UK and other 5G telecoms networks.
Caroline Carruthers, a data consultant, said the concerns of MPs and peers should be examined by the Information Commissioner’s Office because any company that sends its data to China cannot guarantee that the way it is processed will adhere to UK laws.
TikTok has told European users – and MPs in evidence given to parliament – that their data can be accessed by staff in China for limited reasons such as checking the performance of its algorithms. “Lord Bethell has a good point that this is a grey area in law, where we have a potential for the cross-country data transfer laws in the UK to be contradicted by the National Intelligence Law in China, for instance.”
A spokesperson for the ICO said the letter raised “serious concerns” that it would review. “Protecting people’s rights is an important part of our work, and we work closely with organisations, including scrutinising the privacy practices of the big tech platforms. This letter raises serious concerns, and we will be reviewing it in detail,” they added.
TikTok said it had begun work on “a comprehensive plan” to protect European user data, including storing UK user data in its European datacentres and including third-party independent oversight of its approach.
A TikTok spokesperson added that the claims in the letter were “based on fundamental misconceptions”. They said “TikTok’s user data is stored in the US and Singapore, not China” and that the company was incorporated outside of China. “We comply with strict data laws, such as GDPR, in the UK and EU, which also govern data transfers,” they added.
Earlier in the day, responding to the UK government ban, TikTok also blamed “wider geopolitics, in which TikTok, and our millions of users in the UK, play no part”.
