As it continues to work on a deal to keep the app in the U.S., TikTok’s links with the Chinese government are also causing impacts elsewhere, with the platform facing a huge new fine in Europe due to violations of the GDPR.
As announced by the Irish Data Protection Commission (DPC), TikTok has been fined €530 million ($US341 million) for infringements of GDPR regulations relating to the transfer of European user data to China, while it will also be required to revise its processes within the next 6 months.
As noted, the fine is a result of an investigation into the TikTok’s transfers of user data to China, which is not an authorised region under the GDPR regulations, in regards to data safety.
As explained by the DPC:
“Under the GDPR where an organization intends to transfer personal data outside the EU/ EEA to a third country, and where no Adequacy Decision exists between the EU and that third country, such transfers can only occur if other applicable provisions of the GDPR are met, such as Standard Contractual Clauses. These provisions place the responsibility on the organization to verify, guarantee and demonstrate that the law and practices of that country guarantees a level of protection essentially equivalent to that guaranteed within EU.”
Because Chinese regulations don’t align with these requirements, TikTok will now have to pay a hefty fine, and reassess its systems in line with GDPR requirements.
Though TikTok says that it’s already done so.
In response to the announcement, TikTok says that the finding fails to take into account the additional measures it’s now implemented to address the DPC’s concerns:
“The decision primarily focuses on a select period from years ago, before the 2023 implementation of Project Clover, our €12 billion data security initiative. The DPC itself recorded in its report what TikTok has consistently said: it has never received a request for European user data from the Chinese authorities, and has never provided European user data to them.”
TikTok says that Project Clover, for which it’s created several new EU data centers (in Norway and Ireland), and implemented processes to ensure that no EU user data is sent to China, addresses all of the DPC’s complaints, and as such, it should not be subjected to this fine.
“The facts are that Project Clover has some of the most stringent data protections anywhere in the industry, including unprecedented independent oversight by NCC Group, a leading European cybersecurity firm. The decision fails to fully consider these considerable data security measures.”
TikTok further notes that it now has 175 million users across Europe, and more than 6,000 employees in the region, while it’s also helped small businesses contribute €4.8 billion to GDP, and over 51,000 jobs.
“This decision has implications not just for TikTok, but for any company in Europe operating globally. We disagree with this decision and intend to appeal it in full.”
Yeah, I’m not sure that this approach, which is similar to what TikTok has undertaken in the U.S., is going to resonate with EU officials.
The argument that TikTok is already implementing measures to address such is relevant, but TikTok has continually tried to put political pressure on regional regulators, by essentially blackmailing them with veiled threats based on the impact that the company has on the local economy.
U.S. senators were unmoved by these observations, and I expect EU overseers will view such the same way, as it’s a pretty blatant effort to pressure them into easing back on the platform due to its broader economic benefits.
It’s essentially a bullying tactic, which side-steps the actual regulatory ruling itself. And again, TikTok should challenge the ruling by laying out the efforts that it’s made with Project Clover, but it should probably also consider leaving out the impact statement.
I doubt that’s going to change the ruling either, but it may ensure that TikTok avoids further penalties in the region.
Either way, it’s another headache for the app, which now needs to factor in the loss of $341 million, on top of a possible full ban in the U.S., due to the escalating U.S./China trade war.
