News + Trends
EU imposes first DMA fines against Apple and Meta
by Samuel Buchmann
TikTok: 530 million buses, despite European data centres
6/5/2025
Translation: machine translated
TikTok sent personal data of European users to China. The company now has to pay a fine of 530 million euros. The establishment of data centres in Ireland and Norway has apparently come too late.
The Chinese social media giant TikTok has once again been targeted by the European data protection authorities - and has lost. And this time with full force. The Irish Data Protection Commission (DPC) has fined the company 530 million euros. The accusation: illegal data transmission.
What exactly happened?
Specifically, according to the DPC, TikTok violated two key articles of the General Data Protection Regulation (GDPR): Article 46(1), which governs the conditions for international data transfers, and Article 13(1)(f), which governs how TikTok must communicate data sharing to its users (transparency requirement).
The accusations are serious: TikTok has failed to ensure that European users' data enjoys the same protection in China as it does within the EU. In other words, TikTok illegally transferred personal data of European users to China.
TikTok made false statements
A particularly explosive fact: TikTok had informed the DPC in 2024 that it did not store any European data on Chinese servers. The company has now admitted that it discovered back in February that some user data from the European Economic Area (EEA) was indeed being stored in China.
According to DPC, this is not only a violation of applicable data protection law, but also an indication of a fundamental transparency problem within the group. TikTok had provided the supervisory authorities with false information - and thus gambled away additional trust.
The Irish Data Protection Commission is now demanding that TikTok brings its data processing fully in line with the requirements of the GDPR within six months. If this does not happen, all data transfers to China will be stopped immediately. The European authorities want to prevent Chinese authorities from gaining access to the sensitive data of European citizens through legally questionable channels. This is because companies in China are legally obliged to hand over user data at the request of the authorities - similar to the Cloud Act in the USA.
TikTok refers to «Project Clover»
TikTok rejects the allegations. In a public statement, Christine Grahn, European Head of Political Communications at TikTok, explained that the decision does not take into account the data protection measures implemented since 2023 as part of «Project Clover».
Source: newsroom.tiktok.com
TikTok describes Project Clover as a «comprehensive data protection programme», which aims to store and process European user data exclusively in Europe. To this end, the company has already built data centres in Norway and the Republic of Ireland and, according to its own information, has already invested billions. Data storage in China should therefore no longer be necessary for European users. The DPC is not satisfied with this. The implementation and, above all, the traceability of these protective measures have not yet been sufficiently documented. TikTok has so far failed to provide proof of this.
In addition, TikTok is a repeat offender: The company already had to pay a fine of 345 million euros in 2023 - at that time for poor data protection practices in its dealings with children and young people.
TikTok is even to be sold in the USA
However, it is not just Europe that is taking a critical view of the Chinese company. TikTok is also at risk of being banned altogether in the USA due to similar concerns, unless the parent company ByteDance is prepared to sell the US subsidiary. Everything here depends on Donald Trump. Countries such as Albania, Pakistan and Nepal have temporarily blocked TikTok completely - not (only) because of data protection concerns, but because the government fears a potentially negative influence on children and young people.
Header image: Shutterstock
I've been tinkering with digital networks ever since I found out how to activate both telephone channels on the ISDN card for greater bandwidth. As for the analogue variety, I've been doing that since I learned to talk. Though Winterthur is my adoptive home city, my heart still bleeds red and blue.
15 comments
later