DATA PROTECTION | Irish DPA fines social media platform €530 million for unlawful data transfer to China

With a press release dated 4 July 2025, the European Data Protection Board (EDPB) announced the issuance by the Irish Data Protection Authority (Irish DPA) of a fine against TikTok for unlawful cross-border transfers of users’ personal data to China and for failing to comply with the GDPR’s transparency obligations.

The Irish DPA found that TikTok’s employees in China had ongoing remote access to personal data of European users. However, the company failed to demonstrate that the implemented standard contractual clauses and supplementary measures were effective in ensuring adequate protection of personal data, as required by Article 46(1) of the GDPR.

In particular, TikTok did not adopt measures capable of preventing access by Chinese public authorities, whose powers under local counter-espionage and anti-terrorism laws pose significant risks to the confidentiality of user data. Additionally, the Irish DPA found that TikTok’s privacy policy lacked sufficient information about international data transfers, thereby breaching the GDPR’s transparency requirements.

Newsletter n. 109 – July 2025