EU Slaps TikTok with $600M Fine Over China Data Transfers

After a four-year probe, the European Union’s privacy watchdog fined TikTok 600 million dollars (530 million euros) after finding that data transfers from the video sharing application to China placed users at risk of espionage and violated strict EU data privacy regulations.

The Irish Data Protection Commission has also fined TikTok because it was not transparent about the destination of the users’ data. It ordered the company to comply within six months.

Dublin is the European headquarters of the company, and therefore, the Irish watchdog acts as the lead data privacy regulator for the EU’s 27 member states.

In a press release, Deputy Commissioner Graham Doyle stated, “TikTok did not verify, guarantee or demonstrate that personal data of European users, remotely accessed and accessed by Chinese staff, were afforded an equivalent level of protection to that which is guaranteed in the EU.”

TikTok has said that it is not happy with the ruling and will appeal.

In a blog, the company stated that it would focus on a “select time period” that ends in May 2023 before embarking on a project of data localization called Project Clover, which involved building three data centres in Europe.

Christine Grahn is the European head of government and public affairs at TikTok. She said, “Project Clover offers some of the strictest data protections in the industry. This includes an unprecedented level of independent oversight from NCC Group, a European cybersecurity leader. The decision does not fully consider these significant data security measures.”

TikTok’s parent company, ByteDance, which is based in China, was under scrutiny by European officials for how it handled personal data from its users. Western officials were concerned that the app posed a risk to security when sending user data to China. The Irish watchdog fined the company in 2023 for a separate investigation into child privacy.

The Irish watchdog found in its investigation that TikTok did not address the “potential access” by Chinese authorities to European users’ data, under Chinese laws that are “materially different” from EU standards on counter-terrorism, cybersecurity, national intelligence, and anti-spying.

Grahn stated, “TikTok has never been asked by the Chinese authorities for European users’ data, nor has it ever provided European users’ data to them.”

According to the EU’s General Data Protection Regulation (GDPR), European user data may only be transferred out of the EU if safeguards are in place that ensure the same level of protection.

Grahn stated that TikTok disagreed strongly with the Irish regulator’s argument, stating it had sought legal advice and expert opinion. She claimed that TikTok is being “singled out” although it uses “the same legal mechanisms” as thousands of companies in Europe and its approach “is in line” with EU regulations.

In addition, the investigation, which began in September 2021, found that TikTok’s privacy policy did not identify third countries at the time, such as China, to whom user data was sent. The watchdog stated that the policy, updated since, did not explain data processing, including “remote data access by personnel in China to personal data stored on servers in Singapore and the United States.”

The Irish regulator is now looking at TikTok again, claiming that the company has been giving inaccurate information all along by stating that European users’ data was not stored on Chinese servers. The company did not inform the regulator until April of its discovery in February that data was stored on Chinese servers.

Doyle stated that the watchdog takes recent developments “very seriously” and is “considering any further regulatory actions which may be warranted.”