Ireland
[IE] TikTok sanctioned by Irish Data Protection Commission
IRIS 2025-5:1/7
Justine Radel-Cormann
European Audiovisual Observatory
On 2 May 2025, the Irish Data Protection Commission released a decision finding that TikTok infringed the General Data Protection Regulation (GDPR) in relation to the transfer of personal data of its users in the European Economic Area (EEA) to China. The Irish Data Protection Commission concluded that the transfers violated the GDPR’s requirements for cross-border data transfers and its transparency obligation.
Personal data may be transferred to countries outside the EEA if those countries ensure an adequate level of data protection, either through a European Commission “adequacy decision” or by implementing appropriate safeguards such as Standard Contractual Clauses (SCCs) (Articles 45 and 46 GDPR). Since China does not benefit from an adequacy decision, TikTok was required to implement and demonstrate effective safeguards to ensure that EEA users’ data would be protected to a standard essentially equivalent to that within the EU.
According to the Irish Data Protection Commission, TikTok failed to demonstrate that the level of protection granted to users when transferring their data was essentially equivalent to that guaranteed within the EU.
In addition, TikTok’s EEA privacy policy does not respect the GDPR’s transparency requirement. The EEA privacy policy did not provide users with adequate information on the data transfers to a third country (Article 13(1)(f) GDPR).
The Irish Data Protection Commission ordered TikTok to suspend its data transfers and to bring its processing operations into compliance with the GDPR within a period of 6 months. For the two infringements, the Irish Data Protection Commission imposed an administrative fine totalling €530 million.
References
- Irish Data Protection Commission, Press release, "Irish Data Protection Commission fines TikTok €530 million and orders corrective measures following inquiry into transfers of EEA user data to China"
- https://www.dataprotection.ie/en/news-media/latest-news/irish-data-protection-commission-fines-tiktok-eu530-million-and-orders-corrective-measures-following#_ftn1
- Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation)
- https://eur-lex.europa.eu/eli/reg/2016/679/oj/eng
This article has been published in IRIS Legal Observations of the European Audiovisual Observatory.