Ireland’s data regulator is reconsidering sanctions against TikTok after a High Court ruling largely supported the regulator’s findings of serious privacy breaches involving cross-border data transfers from the EU to China. The case has heightened scrutiny on how European authorities enforce data protections when user information moves outside the European Economic Area (EEA).
The original decision from the Irish Data Protection Commission (DPC) imposed a €530 million fine on TikTok, addressing violations of the EU’s General Data Protection Regulation (GDPR). Most of the penalty focused on Article 46, which governs the conditions for transferring personal data internationally, while the rest related to transparency shortcomings under Article 13. The DPC also gave TikTok a deadline to comply, warning that transfers to China could be suspended if adequate protections were not guaranteed.
The key issue centered on TikTok’s inability to prove that data accessed remotely from China received protections equivalent to EU standards. Concerns included whether Chinese authorities could access user data under national laws related to counter-terrorism and espionage without sufficient safeguards. Compounding the situation, TikTok revealed it had stored limited EEA user data on Chinese servers, contradicting earlier statements to regulators.
While TikTok challenged the ruling, the Irish High Court dismissed most of its appeal arguments, reinforcing the regulator’s position. Nevertheless, the Irish Supreme Court temporarily allowed TikTok to continue data transfers pending the appeal outcome, prolonging uncertainty. Now, the DPC must determine whether to enforce new restrictions based on the ruling and TikTok’s latest submissions.
This case serves as a precedent for data transfers between the EU and China, spotlighting the stringent interpretations of GDPR protections amid rising geopolitical and privacy concerns. TikTok maintains it is being unfairly targeted despite relying on transfer mechanisms used by numerous companies. The regulator’s next steps could redefine how cross-border data flows are controlled across Europe.