Ireland fines TikTok 530 million euros for sending EU person knowledge to China

TikTok has been fined 530 million euros ($601.3 million) by means of Ireland’s privateness regulator for sending person knowledge to China.

The Irish Data Protection Commission (DPC) — which leads on privateness oversight for TikTok within the EU — stated Friday that TikTok infringed the bloc’s GDPR knowledge coverage legislation over transfers of European person knowledge to China.

The regulator ordered TikTok to deliver its knowledge processing into compliance inside six months and stated it could droop TikTok’s transfers to China if processing isn’t introduced into compliance inside that time frame.

“TikTok’s personal data transfers to China infringed the GDPR because TikTok failed to verify, guarantee and demonstrate that the personal data of EEA users, remotely accessed by staff in China, was afforded a level of protection essentially equivalent to that guaranteed within the EU,” Graham Doyle, deputy commissioner on the DPC, stated in a observation Friday.

“As a result of TikTok’s failure to undertake the necessary assessments, TikTok did not address potential access by Chinese authorities to EEA personal data under Chinese anti-terrorism, counter-espionage and other laws identified by TikTok as materially diverging from EU standards,” he added.

The DPC stated it additionally discovered TikTok had supplied erroneous data to its inquiry when it claimed it hadn’t saved European customers’ knowledge on servers positioned in China. TikTok knowledgeable the regulator this month that it found out a subject in February the place restricted European person knowledge were saved on servers in China, opposite to its prior statements.

The DPC takes the problem “very seriously” and is thinking about what additional regulatory motion could also be warranted in session with its fellow EU knowledge coverage government, Doyle stated.

TikTok stated it disagrees with the Irish regulator’s resolution and plans to attraction in complete.

In a weblog publish Friday, Christine Grahn, TikTok’s head of public coverage and executive members of the family for Europe, stated the verdict did not consider Project Clover, a 12-billion-euro knowledge safety initiative aimed toward protective European person knowledge.

“It instead focuses on a select period from years ago, prior to Clover’s 2023 implementation and does not reflect the safeguards now in place,” Grahn stated.

“The DPC itself recorded in its report what TikTok has consistently said: it has never received a request for European user data from the Chinese authorities, and has never provided European user data to them,” she added.

TikTok has prior to now said that workforce in China can get entry to person knowledge.

In 2022, it stated in an replace to its privateness coverage that staff in international locations the place it operates — together with China, Brazil, Canada and Israel — are accredited get entry to to customers’ knowledge to make sure their enjoy is “consistent, enjoyable and safe.”

Western policymakers and regulators are involved TikTok’s transfers of person knowledge may just result in Beijing gaining access to the information to undercover agent on customers with the app. Under Chinese legislation, tech corporations are required at hand over person knowledge to the Chinese executive if asked to help with vaguely-defined “intelligence work.”

For its section, TikTok has insisted that it hasn’t ever despatched person knowledge to the Chinese executive. In 2023, TikTok boss Shou Zi Chew stated in written testimony for a U.S. Congress listening to that the app “has never shared, or received a request to share, U.S. user data with the Chinese government.”