TikTok was fined €530 million ($600 million) by Ireland’s Data Protection Commissioner (DPC), the lead privacy regulator in the EU, over concerns about how it handles user data — particularly its transfers of personal data to China.
The DPC found that TikTok, owned by China’s ByteDance, failed to ensure that EU users’ data was adequately protected, especially against potential access by Chinese authorities.
The decision, which was made by the Commissioners for Data Protection, Dr Des Hogan and Mr Dale Sunderland, and has been notified to TikTok, finds that TikTok infringed the GDPR regarding its transfers of EEA User Data to China and its transparency requirements.
“TikTok’s personal data transfers to China infringed the GDPR because TikTok failed to verify, guarantee and demonstrate that the personal data of EEA users, remotely accessed by staff in China, was afforded a level of protection essentially equivalent to that guaranteed within the EU,” DPC Deputy Commissioner Graham Doyle said.
The ruling revealed that although TikTok claimed not to store EU user data in China, it later disclosed that some data had been stored there briefly. The DPC warned TikTok to bring its data practices into compliance within six months or risk being barred from transferring EU data to China.
TikTok disputes the decision and plans to appeal, arguing that it complies with EU rules through standard contractual clauses and has made recent improvements to data security. It emphasized that it has never provided EU user data to Chinese authorities.
This is TikTok’s second major fine from the DPC, following a €345 million penalty in 2023 related to children’s data. The case highlights increasing regulatory pressure on global tech firms under the EU’s General Data Protection Regulation (GDPR).
TelecomLead.com News Desk
