Video-sharing platform TikTok has been fined €530 million by the Irish Data Protection Commission (DPC) for failing to protect the personal data of EU users when transferring it to China, the agency said in a statement on Friday.
DPC Deputy Commissioner Graham Doyle said that the data transfer violated the General Data Protection Regulation (GDPR) because TikTok failed to demonstrate that the personal data of EU users remotely accessed by employees in China “was provided with a level of protection substantially equivalent to that guaranteed within the EU.”
“As a result of TikTok’s failure to conduct the necessary assessments, TikTok has not addressed the potential access of Chinese authorities to the personal data of EEA citizens under Chinese anti-terrorism, counterintelligence and other laws that TikTok has identified as being materially different from EU standards,” the statement said.
TikTok, which has about 159.1 million monthly active users in Europe, must bring its data processing into compliance within six months. If this deadline is not met, data transfers to China will be suspended.
The DPC launched an investigation in 2021 as Europe’s leading privacy watchdog against the company, which is owned by China’s ByteDance.
During the investigation, TikTok told the DPC that it did not store EU user data on servers located in China, but the supervisory authority found evidence contradicting this.
Doyle said the regulator is taking these developments “very seriously.”
“TikTok has informed the DPC that the data has been deleted, but we are considering what further regulatory action may be warranted in consultation with our colleagues at the EU data protection authorities,” he added.
In a statement, TikTok said that “the decision primarily focuses on a specific period many years ago, before the implementation in 2023 of Project Clover, our €12 billion data security initiative.”
“This decision risks setting a precedent with far-reaching implications for companies and entire industries across Europe that operate globally. It is a blow to the competitiveness of the European Union,” the statement said.
This is not the first time that TikTok has been fined under the GDPR: in 2023, it received a fine of 345 million euros for failing to protect children’s privacy.
