TikTok tries its luck in Europe as Project Clover begins

• TikTok has begun its response to data privacy concerns around the app’s links to China.
• TikTok is owned by ByteDance, a Chinese firm that says it has never given data to Beijing.
• A data center has opened in Dublin to ease China spying fears.

TikTok, China and global hysteria: measures are being implemented to assuage fears that data collected by the app will be leaked to – and somehow used by – the Chinese government.

Earlier this year, on the grounds of cybersecurity and privacy (read: widespread paranoia that China is Always Watching), TikTok faced a number of government restrictions of its use. Several institutions banned the app from officials’ devices, including the UK government, the European Parliament, the European Commission, and the EU Council.

Now, Europeans’ data is being moved to servers in Dublin, Ireland. The move is part of what TikTok is calling “Project Clover,” as a nod to the role Ireland is playing.

The measures were announced early this year, so the speed at which they’re being acted on should be reassuring – evidence that TikTok is keen to tackle the issues it’s facing.

“We are a pro-compliance company. Tell us what the problems are, and then let’s work together on the solutions. That’s been our approach in the US, that’s been our approach everywhere,” said Theo Bertram, VP of government relations and public policy.

As well as the center that’s now up and running in Dublin, there are plans for another in Ireland and one in the Hamar region in Norway. These centers will house the data of TikTok’s over 150 million European users.

The remaining two centers will be up by the end of 2024, according to Elaine Fox, head of privacy in Europe.

“We are not waiting for our European data centers to become fully operational… we have already started storing personal data for our EEA and UK users by default in a designated secure area known as the European enclave, which is hosted in the interim in the US,” she said.

Project Clover, which is running parallel to similar measures under the name “Project Texas,” will allow a European security company access to audit cybersecurity and data protection controls.

A key concern that European security officials have is the risk that data TikTok holds on its users could be accessed by the Chinese state. Although TikTok owner ByteDance has repeatedly assured authorities that it has never allowed Chinese authorities to access the data it collects, there’s an inherent lack of trust because ByteDance’s headquarters are in Beijing, and the Chinese government has the right to collect and view any data that might be pertinent to its national security, under a 2017 law.

Authorities imposing bans warned that emails, contacts, and other communication could be accessed by Beijing as a result of having the app downloaded.

Alongside the announcement that the first data center had come online, Theo Bertram said a third-party security company would also be used to independently audit TikTok’s work at the data center.

Progress update on Project Clover:
1. establishing secure European enclave with reinforced protections
2. new data centre in Ireland now online & European data migration fully underway
3. highly respected NCC Group as the independent security providerhttps://t.co/7HPtGSoDcj

— Theo Bertram (@theobertram) September 5, 2023

TikTok’s data controls under Project Clover will be scrutinized by NCC Group, a global cybersecurity company with offices across Europe, and any incidents reported.

Stephen Bailey, global director of privacy at NCC Group, said he was proud TikTok had chosen the company to be its third-party security provider on the project.

“Our objective scrutiny, monitoring and assurance means platform users in Europe and the UK can have confidence in the enhanced data security standards that TikTok is setting, which go above and beyond European regulatory requirements,” he said.

TikTok said that NCC Group would identify and respond to any “suspicious or anomalous access attempts” and would work on enhancing security.

Next, TikTok and NCC Group will engage with policymakers across Europe to explain how this system will work in practice.

Will TikTok finally be in clover over its user data?