TIKTOK HAS BEEN hit with a €530 million fine by Ireland’s data data protection regulator for breaching privacy rules.

The hefty penalty was over TikTok transferring EU users’ personal data to China, where the information could be “remotely accessed by staff” at the company’s global headquarters.

In its ruling, the Data Protection Commission (DPC) made an order requiring TikTok to bring its processing of users’ data into compliance within 6 months.

The decision also includes an order suspending TikTok’s transfers to China if processing is not brought into compliance within this timeframe.

DPC Deputy Commissioner Graham Doyle said that the EU’s General Data Protection Regulation (GDPR) requires the same level of protection provided within member states where personal data is transferred to other countries outside of the bloc.

“TikTok’s personal data transfers to China infringed the GDPR because TikTok failed to verify, guarantee and demonstrate that the personal data of EEA users, remotely accessed by staff in China, was afforded a level of protection essentially equivalent to that guaranteed within the EU,” Doyle said.

“As a result of TikTok’s failure to undertake the necessary assessments, TikTok did not address potential access by Chinese authorities to EEA personal data under Chinese anti-terrorism, counter-espionage and other laws identified by TikTok as materially diverging from EU standards.”

The DPC said in its decision that TikTok had submitted “erroneous information” to the inquiry, having initially informed the regulator that it “did not store EEA User Data on servers located in China”.

But the DPC said this position changed last month, when TikTok informed investigators of an issue that it had discovered in February where “limited” user data had “in fact been stored on servers in China”, contrary to previous evidence.

“TikTok informed the DPC that this discovery meant that TikTok had provided inaccurate information to the Inquiry,” the DPC said.

While the fine is sizable, it’s dwarfed by a €1.2 billion fine against Meta and also not as high as a €746 million penalty levied on Amazon.