TikTok has violated the General Data Protection Regulation (GDPR), according to the Irish Data Protection Commission (DPC), which is responsible for enforcing European law. The investigation, which began in 2021, did not look very good for the Chinese social network. This has been confirmed, on two important points of the text.
Six months to comply
First, TikTok has not demonstrated that European Union user data transferred to China was protected to a level equivalent to that guaranteed in the EU. The company has not sufficiently assessed Chinese laws (on anti-terrorism, cybersecurity, intelligence, etc.) that potentially allow authorities to access the data.
Second, TikTok has not adequately informed users about these transfers. Its 2021 privacy policy did not specify the countries concerned (including China) or the precise nature of the processing. These breaches justify a total fine of €530 million, divided between €485 million for insufficient transfer guarantees and €45 million for the lack of transparency.
TikTok now has six months to comply with the GDPR. If it does not, the network will simply have to suspend its data transfers to China. To make matters worse, the app provided erroneous information during the investigation, particularly regarding the storage of European user data in China. TikTok waited until February (!) to finally admit that "limited" data had indeed been hosted on Chinese servers. It has since reportedly been deleted.
The Chinese company intends to appeal the DPC's decision. She assures that European user data has not been transmitted to the Chinese government, nor has she received any request to do so. The facts she is accused of date back to before the implementation of the "Clover project," which consists of hosting the personal data of Europeans in Europe (in this case, Ireland and Norway).
The Irish commission nevertheless believes that these efforts do nothing to alleviate the legal risks associated with Chinese laws. Clara Chappaz, the Minister for Digital Affairs, takes "note" of TikTok's appeal, and explains that "the personal data of our fellow citizens is precious and must not be transferred abroad without sufficient protection." She will meet with TikTok executives in Dublin next week to discuss child protection and data protection measures. Source: DPC
0 Comments