TikTok has been fined $600 million by European regulators for unlawfully transferring users' personal data from the European Union (EU) to China. This penalty, issued by Ireland's Data Protection Commission, is one of the largest levied under the EU's General Data Protection Regulation (GDPR). The investigation concluded that TikTok did not adequately protect the data accessed by its employees in China, failing to ensure that it met EU-level data protection standards.
The regulatory body highlighted that TikTok misled users by not specifying China as a destination for their data and failing to disclose the extent of remote access from Chinese locations. This lack of transparency was seen as a violation of GDPR rules. Deputy Commissioner Graham Doyle pointed out that TikTok's inability to conduct necessary assessments raised concerns about potential access by Chinese authorities to personal data of EU citizens.
The fine consists of approximately $550 million for unlawful data transfers and $50 million for violations of transparency obligations. Regulatory scrutiny of major technology firms' data practices continues to grow in Europe, and TikTok could face a suspension of data transfers to China if it does not comply with the ruling within six months.
In response to the fine, TikTok announced its intention to appeal, stating that the ruling fails to recognize significant reforms made under its "Project Clover" initiative aimed at enhancing data security. The company emphasized that it has never complied with requests from Chinese authorities for European user data.
This penalty follows a previous fine of $368 million imposed on TikTok in 2023 for inadequately protecting children's data. The ongoing regulatory actions against TikTok mirror broader concerns regarding data privacy among tech giants, including a notable $1.3 billion fine issued to Meta for similar issues.