The federal government’s move to ban TikTok on its phones should make companies think twice about their data policies and consider blocking the app on its own devices, academics say.
Data privacy and technology professors say Ottawa’s ban of the app, along with an investigation into the company launched last week by a group of Canadian privacy commissioners, should be enough to push companies into thinking critically about social media.
TikTok, a video-based social media platform where users share music, dancing, instructional content and commentary, has long been embroiled in privacy concerns because its parent company ByteDance is based in China, where laws allow the country to demand access to user data.
The app’s privacy policy says it collects everything from email addresses and phone numbers to the content uploaded and information on users’ keystroke patterns, battery levels, audio settings and locations.
“Given the Chinese government’s track record of collecting secret information,if I was running an enterprise … I would certainly be advising my employees not to have this installed on their own devices,” said Brett Caraway, a professor of media economics at the University of Toronto.
Companies may need to be especially wary of the app if their employees deal with intellectual property, patents and trade secrets, which could potentially fall into Chinese hands, he warned.
“But it’s not just strictly a Chinese phenomenon,” he said.
Get breaking National news
“The U.S. government has had similar provisions as well, and there’s plenty of U.S. digital intermediary platforms that have transferred data back to the U.S. government, allegedly for national security reasons.”
Asked whether they would ban TikTok from corporate devices, Canada’s top banks, telecommunications companies and several businesses with Chinese operations, including Tim Hortons owner Restaurant Brands International, Canada Goose and Sun Life Financial, did not respond.
Whether companies require employees to remove TikTok from their phones should depend on the nature of their business and the amount of sensitive information staff would handle on those devices, said Sam Andrey, director of policy and research at the Leadership Lab at Toronto Metropolitan University.
“I don’t want to say a blanket statement but I think the government’s ban should serve as a reminder to companies to review their security and privacy practices writ large,” he said.
But Sara Grimes, director of the Knowledge Media Design Institute at the University of Toronto, said banning the app on corporate phones doesn’t seem “feasible” because the government has provided little information about the reason for its decision to end the use of TikTok on its devices.
In announcing the ban, Treasury Board President Mona Fortier offered only “an unacceptable level of risk to privacy and security” as the reason.
“Banning an incredibly popular app based on vague, undefined concerns leads to dangerous territory,” Grimes said in an email.
“What Canadian companies might want to do is call for more information about why these various governments around the world are banning this specific app and how they reached that decision.”
She suspects some companies will react by erring on the side of caution, while others will dismiss any suggestion of a ban as an “overaction” and continue to use the app.
Regardless of which route they go in, Vivek Krishnamurthy, a law professor at the University of Ottawa, said companies should think “long and hard” about their data privacy practices and undertake a risk assessment designed to uncover how exposed they might be to TikTok.
He said, “I would hope that they have their own houses in order with regard to how they collect and handle personal data of Canadians and people around the world.”
Comments