TikTok back in the dock over data transfers to China

TikTok’s week has gone from bad to worse after the Irish Data Protection Commission has confirmed it is launching a new investigation into how the social media giant transfers European users’ personal data to servers in China.

The new inquiry not only follows a previous ruling by the Irish DPC which slapped a €530m fine on TikTok in connection with a different type of transfer of European users’ data to China but comes just 48 hours after the company lost the first round of its appeal against a £12.7m penalty imposed by the UK Information Commissioner’s Office in 2023.

TikTok maintained throughout the first Irish DPC inquiry that no European users’ data was stored on servers located in China, claiming transfers of data took place by way of Chinese staff remotely accessing data stored on European servers.

However, TikTok eventually said it had “discovered” some limited European users’ data had in fact been stored on servers located in China, meaning its evidence had been wrong.

At the time, the Irish DPC said it was “deeply concerned” that TikTok had submitted inaccurate information to that inquiry.

In its press release issued at the time, the regulator stated it was taking those developments “very seriously” and was “considering what further regulatory action may be warranted, in consultation with our peer EU Data Protection Authorities”.

As a result it has now decided to open this new inquiry.

The inquiry will consider the following provisions of the GDPR: Articles 5(2) (accountability), 13(1)(f) (transparency information in relation to third country transfers), 31 (obligation to cooperate with the supervisory authority) and Chapter V GDPR (compliance with the relevant requirements for third country transfers).