Chinese social media platform TikTok, which allows users to create, share, and watch short videos, was fined €530 million for violating GDPR regulations, which translates to 2.3 billion złoty, for failing to protect the privacy of its users through the unauthorized transfer of personal data to China. The fine was imposed by the Irish Data Protection Commission (DPC), the equivalent of the Polish supervisory authority, the President of the Personal Data Protection Office. This authority handled the TikTok case due to the location of its European headquarters.
What was it actually about? According to Article 3(1), the GDPR applies to the processing of personal data in connection with the activities of an establishment of a controller or processor in the Union, regardless of whether the processing takes place in the Union.
Regardless of the fact that ByteDance, the owner of Tiktok, placed the first data center in Norway and recently announced its intention to create another one in Finland, the fine was imposed for the previous unlawful processing of data, lack of transparency and failure to ensure an adequate level of security for the processed personal data.
In 2023, TikTok launched the Clover project, which aimed to increase the security of personal data for users in the European Union, providing a rigorous approach to personal data protection. The project itself cost €12 billion. The supervisory authority's decision primarily covers the period before Clover's implementation.
TikTok maintained that it had never shared personal data with Chinese authorities and had never received requests from them in this regard. Furthermore, in 2025, ByteDance itself reported alleged "trace" amounts of EU users' personal data hosted on Chinese servers, contradicting previous claims. It should be noted that TikTok has 175 million users in Europe. The data on the Chinese servers was allegedly processed in connection with remote access by employees from China. However, pursuant to Article 46 of the GDPR, in the absence of a decision establishing an adequate level of security guaranteed by a state, a controller or processor may transfer personal data to a third country or an international organization only if they provide appropriate safeguards and provided that enforceable data subject rights and effective legal remedies are in place. In this case, no adequate technical and organizational measures ensuring an adequate level of security of the personal data being processed were identified.
TikTok has already responded to the imposed fine, indicating that the supervisory authority did not take into account the implemented Clover project and adopted security standards, and plans to appeal against it.
This article is for informational purposes only and does not constitute legal advice.
Legal status as of May 6, 2025.
author:
Be the first to receive our articles and legal alerts, straight to your inbox! Sign up for our newsletter by clicking the link or contact us at social@kglegal.plto personalize your content.
