TikTok has been hit with a 530 million euros (USD601 million) fine by Irish data protection authorities on Friday for breaching European privacy rules, marking it one of the largest penalties ever imposed under the General Data Protection Regulation (GDPR).
The ruling follows a lengthy investigation by Ireland’s Data Protection Commission (DPC), which found the Chinese-owned platform violated GDPR by transferring European users’ personal data to China, where it was accessed by engineers.
The penalty is the third largest ever imposed by the DPC, trailing only Amazon’s 746 million euros fine and Facebook owner Meta Platforms’ record 1.2 billion euros sanction.
The DPC concluded that TikTok’s parent company, ByteDance, failed to implement adequate safeguards around how personal data from users in the European Economic Area (EEA) was accessed overseas.
“TikTok’s personal data transfers to China infringed the GDPR because TikTok failed to verify, guarantee, and demonstrate that the personal data of EEA (European Economic Area) users, remotely accessed by staff in China, was afforded a level of protection essentially equivalent to that guaranteed within the EU,” DPC Deputy Commissioner Graham Doyle said in a statement.
“As a result of TikTok’s failure to undertake the necessary assessments, TikTok did not address potential access by Chinese authorities to EEA personal data under Chinese anti-terrorism, counter-espionage, and other laws identified by TikTok as materially diverging from EU standards.”
TikTok has said it would appeal the decision and warned the ruling could have sweeping consequences for other global companies handling cross-border data flows.
*** BASAHIN SA WIKANG PILIPINO
Pinatawan ng multa na 530 milyong euro (katumbas ng USD601 milyon) ang TikTok ng mga awtoridad sa proteksyon ng datos ng Ireland nitong Biyernes dahil sa paglabag sa mga panuntunan sa privacy ng European Union, isa sa pinakamalalaking parusang naipatupad sa ilalim ng General Data Protection Regulation (GDPR).
Ang desisyon ay bunga ng matagal na imbestigasyon ng Ireland’s Data Protection Commission (DPC), na natuklasang nilabag ng platformang pag-aari ng China ang GDPR sa pamamagitan ng paglilipat ng personal na datos ng mga European user patungong China, kung saan ito ay na-access ng mga inhinyero.
Pangatlo ito sa pinakamalaking multang ipinataw ng DPC, kasunod ng €746 milyon ng Amazon at €1.2 bilyon ng Meta Platforms, ang kumpanya sa likod ng Facebook.
Napag-alaman ng DPC na ang kompanyang magulang ng TikTok, ang ByteDance, ay nabigong magpatupad ng sapat na mga pananggalang kung paano ina-access sa ibang bansa ang personal na datos ng mga user mula sa European Economic Area (EEA).
Ayon kay DPC Deputy Commissioner Graham Doyle, “TikTok’s personal data transfers to China infringed the GDPR because TikTok failed to verify, guarantee, and demonstrate that the personal data of EEA (European Economic Area) users, remotely accessed by staff in China, was afforded a level of protection essentially equivalent to that guaranteed within the EU.”
Dagdag pa niya, “As a result of TikTok’s failure to undertake the necessary assessments, TikTok did not address potential access by Chinese authorities to EEA personal data under Chinese anti-terrorism, counter-espionage, and other laws identified by TikTok as materially diverging from EU standards.”
Inihayag ng TikTok na balak nitong iapela ang desisyon at binalaan na maaaring magkaroon ito ng malawakang epekto sa iba pang kumpanyang pandaigdigang humahawak ng datos na lumalampas sa mga internasyonal na hangganan.
