“TikTok did not address potential access by Chinese authorities to EEA personal data under Chinese anti-terrorism, counter-espionage and other laws identified by TikTok as materially diverging from EU standards,” said Graham Doyle, a deputy commissioner at the DPC
TikTok owner ByteDance Ltd. was fined €530 million ($600 million) by the European Union for illegally sending user data to China, and warned that it didn’t do enough to keep that information out of reach from Chinese state services.
Ireland’s Data Protection Commission, the company’s main regulator in Europe, said TikTok infringed the bloc’s rulebook with the data transfers and gave it six months to suspend all illegal transfers.
The DPC said TikTok disclosed in April that European user data had been stored on servers in China — contradicting earlier evidence it sent to the regulator. Bloomberg reported the fine earlier.
“TikTok did not address potential access by Chinese authorities to EEA personal data under Chinese anti-terrorism, counter-espionage and other laws identified by TikTok as materially diverging from EU standards,” said Graham Doyle, a deputy commissioner at the DPC.
TikTok said it would appeal the decision in full and that it has never received a request for European user data from the Chinese authorities, and has never provided European user data to them.
The penalty marks the third highest under GDPR rules following earlier fines of €1.2 billion against Meta Platforms Inc. and €746 million against Amazon.com Inc.
TikTok has been in the cross hairs of the Irish regulator before. In September 2023, it was fined €345 million for alleged lapses in the way it cares for children’s personal data.
The watchdog has also sounded the alarm over Big Tech firms shipping the personal data of European citizens outside of the bloc.
The Irish probe into TikTok started in 2021, when the regulator’s then head claimed that EU user data could be accessed by “maintenance and AI engineers in China.”
Aside from privacy, TikTok is also under investigation as part of the EU’s content moderation rulebook, the Digital Services Act, over suspicions that it didn’t do enough to stop fake accounts and foreign powers from interfering with last year’s Romanian presidential election.
It’s also been probed over its addictive design and alleged failure to protect minors who use the platform.