France: CNIL investigates TikTok regarding exercise of data subject rights, data transfers outside EU, protection of minors
OneTrust DataGuidance confirmed, on 12 August 2020, with the French data protection authority ('CNIL') that it is investigating TikTok Inc. following a complaint regarding a request for the deletion of a video. In particular, a CNIL spokesperson said, "To date, CNIL is continuing its investigations and is participating in the European work in progress [...] At this stage, the main points of attention noted by CNIL are also the issues of information for individuals, the way in which rights are exercised, flows outside the EU, and the measures taken with regard to minors, for whom the application is very popular."
In addition, the spokesperson noted, "After investigation, the complainant was invited to exercise their rights with TikTok under the General Data Protection Regulation (Regulation (EU) 2016/679) ('GDPR'), a step that they had not taken beforehand."
Lastly, the spokesperson highlighted, "The investigations could eventually fall under the sole responsibility of the Irish [Data Protection Commission ('DPC')], which will have to deal with the case in cooperation with the other European data protection authorities. In order to fall under the sole competence of the [DPC] and not under the competence of each of the authorities, TikTok will nevertheless have to prove that its establishment in Ireland meets the conditions of a 'principal place of business' within the meaning of the GDPR."