The Irish data protection authority has fined TikTok €530 million. The popular app does not comply with EU data protection rules. In addition, the platform must stop sending European user data to China within six months if its processing is not in line with the rules.
The Irish Data Protection Commissioner (DPC) has determined that TikTok has failed to demonstrate that the personal data of EU users, some of which is accessible to employees in China, is afforded the high level of protection required by EU law. The platform has not taken sufficient measures to prevent Chinese authorities from potentially accessing this data.
TikTok, owned by the Chinese company ByteDance, strongly disputes the findings and points out that it has used the EU’s own legal framework. In particular, it has used standard contractual clauses to grant strictly controlled and limited external access. The platform intends to appeal the ruling.
Unexpected data storage in China
It is striking that during the four-year investigation, TikTok consistently claimed that no EU user data was stored on servers in China. However, last month the company revealed that it had discovered in February that a limited amount of data had been stored in China, which has since been deleted.
“The DPC is taking these recent developments very seriously. We are considering what further regulatory action may be warranted,” said DPC Vice-Chair Graham Doyle. This is the second time the DPC has reprimanded TikTok. In 2023, the platform was fined €345 million for violating privacy rules surrounding the processing of children’s personal data in the EU.
Measures and response
TikTok emphasizes that the decision ignores the security measures the company rolled out in 2023. These measures independently monitor external access and ensure that EU user data is stored in special data centers in Europe and the United States.
“This ruling risks setting a precedent with far-reaching consequences for companies and entire industries across Europe that operate on a global scale,” TikTok said in a statement. The platform adds that it has never received a request from Chinese authorities for EU user data or provided them with any data.
Tip: TikTok funnels sensitive data from American users to China