TikTok’s Handling of EU User Data in China Comes Under Scrutiny Again – Source: www.infosecurity-magazine.com

The Irish Data Protection Commission (DPC) has launched a new inquiry into the storage of European users’ data on servers in China, just two months after it fined the company €530m for similar reasons.

The probe into TikTok, which is owned by Chinese firm ByteDance but has European headquarters in Dublin, was announced on July 10.

TikTok had previously consistently maintained during a four-year investigation by the DPC that it did not store EU user data in China. However, in April, TikTok disclosed that it had discovered two months prior that a small amount of data had been stored in China and had since been removed.

While the initial investigation conducted by the DPC, which led to the fine, focused on TikTok’s China-based staff accessing European user data, this new probe will specifically investigate the storage of EU users’ data in China, which was not considered in the previous investigation.

TikTok is challenging the regulator’s sanction, arguing that the ruling could establish a precedent with significant implications for businesses and entire sectors across Europe that operate internationally.

Also on July 10, the First-tier Tribunal in the UK confirmed that the Information Commissioner’s Office (ICO), the British data regulator, does indeed have the power to issue a monetary penalty notice (MPN) to TikTok.

This means that the ICO is likely to be allowed to issue a £12.7m ($17.3m) fine for multiple infringements of the UK GDPR, as announced in April 2023.

Infosecurity has reached out to ByteDance for comment on the new inquiry, but a spokesperson was not immediately available.

Photo credit: Camilo Concha / Charles-McClintock Wilson / Shutterstock.com