TikTok Fined $600 Million for Transferring European User Data to China

On Friday, Tiktok was fined 530 million euros ($600 million) for breaching the European Union’s data privacy regulations after regulators found that personal data of users was wrongly transferred to China.

Ireland’s Data Protection Commission announced the penalty, stating that Tiktok did not adequately safeguard data from its European users, including some accessible to staff in China, violating the EU’s General Data Protection Regulation (GDPR).

This fine ranks among the largest under the GDPR and adds to the difficulties faced by Bitedan, Tiktok’s Chinese parent company, especially amidst U.S. pressures on non-Chinese companies to divest or face bans in the U.S. The Irish authorities noted that if Tiktok fails to fulfill specific requirements, it may be ordered to cease data transfers to China within six months.

European regulators indicated that Tiktok’s insufficient protections risked user information across the 27-nation bloc. Irish authorities further stated that the Chinese government could potentially access data from users under its anti-terrorism and espionage laws.

With approximately 175 million users in Europe, Tiktok stated it complies with EU laws, asserting that it “has never received requests for European user data from Chinese authorities and has never provided them with such data.”

Tiktok plans to contest the ruling, which could lead to a protracted court battle with the Irish government, Tiktok’s primary regulator in Europe. The company’s European headquarters is situated in Ireland, which is responsible for enforcing GDPR.

Tiktok mentioned that the Irish Data Protection Commission did not take into account its 2023 initiative to invest 12 billion euros in data protections for users within the EU, including the development of a data center in Finland.

The company cautioned that “this ruling may establish precedents that could have widespread repercussions for European companies and industries operating globally.”

Last month, Ireland’s regulators announced that Tiktok had uncovered a “limited” amount of user data stored on servers in China, following a series of denials.

Graham Doyle, vice-chairman of Ireland’s Data Protection Commission, commented on the situation in a statement.