The Irish Data Protection Commission (DPC) has fined TikTok €530 million (£451.8 million) for breaching EU privacy rules by sending users’ data to China.

The DPC said that the social media platform had ‘failed to verify, guarantee and demonstrate’ that EU citizens’ data was provided the same levels of protection afforded in Europe, flouting GDPR rules on the transfer of data outside the EU.

According to the DPC, while TikTok argued that such data transfers are not subject to problematic Chinese laws, its own legal assessment submitted during the inquiry outlined several Chinese regulations, including the Anti-Terrorism Law, the Cybersecurity Law, and the National Intelligence Law, that fall short of EU data protection standards.

The watchdog told TikTok it had not demonstrated adequate safeguards for EU users’ data, and as a result, was unable to verify or guarantee that this data would be protected to EU standards.

The DPC also said that while TikTok had initially told EU regulators it did not store EU user data on servers located in China, last month the platform let the DPC know it had discovered limited data had been stored on Chinese servers for a period of time.

As part of its decision, the DPC ordered the suspension of data being transferred to China, and told TikTok that it must bring its processing operations in line with GDPR within six months.

“The DPC is taking these recent developments regarding the storage of EEA User Data on servers in China very seriously,” said DPC deputy commissioner Graham Doyle.

“Whilst TikTok has informed the DPC that the data has now been deleted, we are considering what further regulatory action may be warranted, in consultation with our peer EU Data Protection Authorities.” 

At the same time, the data watchdog said that the video-sharing app also hadn’t met the stringent transparency requirements under EU law, with users not being given adequate information on the transfer of their data to a third country.

“The GDPR requires that the high level of protection provided within the European Union continues where personal data is transferred to other countries,” said Doyle.

However, the DPC did acknowledge that TikTok had updated its privacy policies during the course of the investigation to let users know their data was being stored and accessed in third countries.

Regardless, the findings underline ongoing concerns about the compatibility of Chinese legal frameworks with GDPR requirements, particularly when it comes to government access and surveillance powers.

Responding to the fine, TikTok’s head of public policy and government relations for Europe, Christine Grahn, said that the platform has ‘never received a request for European user data from the Chinese authorities, and has never provided European user data to them’.

“The DPC contends that we did not undertake necessary assessments. We strongly contest this, having carried out detailed assessments with advice from external law firms and experts,” said Grahn.

“This ruling risks setting a precedent with far-reaching consequences for companies and entire industries across Europe that operate on a global scale. It delivers a blow to the European Union’s competitiveness.”

Recommended reading

• Irish Watchdog Probes X Over AI ‘Data Grab’
• Meta Delays AI Training in Europe Following Regulatory Concern
• Children First See Violent Online Content at Primary School Age

Grahn also said that the decision failed to take into account TikTok’s €12bn investment in its Project Clover data security initiative that will see user data stored outside China in a dedicated European data enclave, hosted across data centres in Norway, Ireland, and the US.

“If the extensive measures implemented under Project Clover, which are the most robust and stringent data safeguards in our industry and beyond, as well as independent, third-party monitoring by NCC Group—are deemed insufficient, it’s reasonable to ask: what would be considered sufficient?,” said Grahn.

“It is regrettable that the DPC does not appear to have given these comprehensive protections the substantive consideration they warrant.”