EU Watchdog Fines TikTok €530 Million Over Data Protection

Acting on behalf of the European Union, Ireland’s Data Protection Commission (DPC) has issued TikTok a €530 million fine (roughly $600 million USD). The fine comes after an investigation found the app was sending data of EU residents to servers in China, violating the General Data Protection Regulation (GDPR).

The DPC is TikTok’s lead privacy regulator in the EU because the company’s European headquarters are based in Dublin. In its May 2 announcement, the commission also criticized TikTok for a lack of transparency and ordered the company to ensure compliance with EU regulations within six months.

DPC Deputy Commissioner Graham Doyle said in a statement: “TikTok’s personal data transfers to China infringed the GDPR because TikTok failed to verify, guarantee and demonstrate that the personal data of EEA users, remotely accessed by staff in China, was afforded a level of protection essentially equivalent to that guaranteed within the EU.”

The GDPR has been consistently named as the strictest data protection law in the world, and the Irish watchdog is very proactive with its enforcement. Just last month, the DPC launched an investigation into X’s use of posts by European residents to train its Grok AI model.

In a statement issued the same day as the DPC’s, TikTok said it plans to appeal the decision, arguing that it carried out “detailed [data sharing] assessments” with “advice from external law firms and experts.”

Christine Grahn, TikTok’s head of Public Policy & Government Relations in Europe, also mentioned “Project Clover,” a data security initiative that seeks to build secure data centers across the EU. She said the project includes “strict access controls [to] ensure that employees in China have no access to restricted data.”

“The decision fails to fully consider Project Clover, our €12 billion industry-leading data security initiative that includes some of the most stringent data protections anywhere. It instead focuses on a select period from years ago, prior to Clover’s 2023 implementation and does not reflect the safeguards now in place.”

Both the DPC and TikTok agree that Chinese authorities did not request European user data during the investigation period.

This fine comes as TikTok’s fate in the US hangs in the balance over concerns regarding its Chinese ownership.