In a statement released on the 29th of June 2020, TikTok, the Chinese video-sharing social networking service owned by ByteDance, announced its decision to move the responsibility for safeguarding the privacy of its European users to its Irish and UK entities.
TikTok’s parent company ByteDance was founded in 2012 by Zhang Yiming. TikTok is generally used to create brief dance, lip-sync, comedy and talent videos. The service generated an impressive $176.9 million in revenue in 2019, representing 71% of the total $247.6 million in revenue the app has created to date. TikTok has attracted around one billion users in its short life, and has proved particularly attractive for the youth market. All indicators suggest that its popularity continues to grow.
According to the announcement, from July 29th 2020 the service provider for EEA-Swiss users will relocate to TikTok Ireland. The United Kingdom office will take charge of service provision for UK users. TikTok UK becomes data controllers for users in the EEA, Switzerland and the UK itself.
The Irish Base
In January 2020, the company had announced that it intended to establish a new European base in Ireland’s capital city, Dublin, employing some 100 people. TikTok employs more than 1,000 people in all of Europe, with 800 of those workers based in the United Kingdom and the Republic of Ireland. London is set to remain as a major office for the company (its second largest in fact) with a trust and safety hub in Dublin headed up by its head of that department, Cormac Keenan.
The principal motivation for opening this new Irish base would appear to be the combined effects of Brexit and the need for the company to ensure that it is compliant with the General Data Protection Regulation, or GDPR.
Brexit has created a void with respect to one of the key functions that the London base would have, until now, fulfilled for TikTok. That is to say, its need for an EU representative office.
The General Data Protection Regulation
As a quick reminder, the GDPR (which has been in force since May 25th, 2018) applies to any data controller and/or processor – no matter where in the world they are based – that deals with the data of European Union citizens or residents.
Any person or organisation that deals with personal data of European origin therefore needs to respect general compliance standards. In addition to this however, businesses based outside Europe must take steps to ensure that they are available to the relevant regulatory authorities when required. The key step in this particular requirement is to designate a Data Representative located within a member state of the European Union.
Below is an explanation of the role of the Data Representative and an explanation as to why – like an increasing number of multinationals – TikTok may have chosen the Republic of Ireland for this purpose.
EU Data Representative
Article 27(3) of the GDPR defines the Data Representative. According to the legislation, the representative is required to ;
“…be established in one of the Member States where the data subjects, whose personal data are processed in relation to the offering of goods or services to them, or whose behaviour is monitored, are.”
The Representative can be a natural or legal person based in part of the European Union, evidently as an EU member state the Republic of Ireland fulfills this most basic requirement. A point of contact for the EU or the relevant state GDPR enforcement authorities, the Data Representative is present to handle any issue or query related to the company’s data handling.
A post-Brexit World
For numerous international, but in particular US companies, the United Kingdom appeared to be a good option for an EU Data Representative office when the GDPR was first being drafted. First and foremost, the English language together with the common law legal system offered evident advantages to organisations more familiar with American business practices. Nonetheless, the small matter of the 2016 referendum in the UK on its continued membership of the European Union has put paid to that idea. Brexit means that the United Kingdom is no longer an option for those who need to appoint an EU data representative for the first time, and additionally means that companies which already had a UK-based representative in place now need to find a new one.
Why Ireland?
Any one of the 27 remaining member states of the EU could host a non-European company’s data representative. Why, therefore is the Republic of Ireland quickly emerging as a popular choice for international companies? As mentioned briefly above, the pre-Brexit UK was seen as a suitable choice for a representative office in part because of the English language and also because (like most Anglophone nations) its common law legal system. It is therefore important to look at those points in a little more detail.
The English Language
Although Gaelic is defined as the nation’s ‘first’ language in the Irish constitution, English also enjoys status as one of the Republic of Ireland’s two official languages. While many passionate speakers of Gaelic remain, the reality is that the everyday language of 21st century Ireland is most definitely English.
It must of course be acknowledged that a growing number of European professionals speak English fluently. Nonetheless, it is quite reassuring for any company to know that it is corresponding in its own language with fellow native speakers.
Common Law
After the UK completes its withdrawal, the only remaining European Union member state functioning on a common law legal system will be Ireland. Maltese law does incorporate some common law principles but given that it is equally influenced by continental civil law, it is more accurately described as a hybrid legal system. Most member states employ some variant of the French Napoleonic code.
It is worth stressing that none of these legal systems are particularly problematic of themselves; all must conform to a common set of core values to be member states of the European Union after all. It is overly simplistic to suggest that the Irish legal system is ‘better’ than that of Germany or Spain for example, but it is true that the similarity of the Irish legal approach, that is to say, another common law legal system, provides a welcome familiarity for the average American company. Like the United Kingdom, the Republic of Ireland has a very similar approach to the US system in general terms. It is accurate to say that the legal system which resembles Britain’s the most is that of its close neighbour and former colony Ireland.
For any company practiced with doing business with the UK, the opening of a European data representative office in Ireland is the most obvious option for any required readjustment following Brexit.
Other Irish Advantages
Regulation
Industry specialists have described the Republic of Ireland’s regulation approach as ‘amicable’ in general when compared to many of its neighbors. Interestingly, the Irish regulator (the Data Protection Commission or DPC) actually has a statutory obligation to favour an amicable resolution to any given regulatory complaint over more punitive action if that is at all possible.
The DPC is presently responsible for regulating the non-American activity (worldwide) of Linkedin, Facebook, Microsoft, Twitter, and Google plus others. Also under its remit are the data controlling activities of the Irish state, in addition to the domestic activities of other more modestly sized businesses and organisations.
Only 70 employees are presently employed by the Irish regulator. It has been suggested, therefore, that the DPC might be overstretched in its workload, and to date has been more focused on pursuing enforcement against larger as opposed to smaller data controllers and processors.
Taxation
Ireland has two rates of corporation tax, one of which is only 12.5%.
This rate is applicable to the trading income of any business which carries out a trade in Ireland, also included are some qualifying foreign dividends payable from trading profits. Broadly speaking when a company conducts business in the Irish Republic on an habitual basis it may be considered to be a trading entity for tax purposes.
Workforce
The Irish tech sector is currently booming. Multinational giants including Intel, Apple, Google, and Facebook all have operations in Ireland. The reasons why are set out above, but as the saying goes, success breeds success. The fact that numerous tech companies are already based in Ireland has had the organic consequence of offering huge training opportunities to the country’s youthful tech workforce. The burgeoning IT sector has provided young Irish with the chance to train and gain experience with leading companies right on their doorstep. Additionally, European and international talent has been attracted to the Emerald Isle. All forecasts suggest that post-Brexit, the draw of Ireland for IT professionals from mainland Europe and beyond will strengthen further.