TikTok owner ByteDance will face a potential fine as soon as next week from Ireland’s Data Protection Commission following an investigation into possible transfers of users’ data to China, a commissioner at the authority told MLex. A decision would come after increased scrutiny of TikTok. In January, advocacy group NOYB filed complaints against TikTok, AliExpress, Shein, Temu, WeChat and Xiaomi for alleged unlawful data transfers to China.
TikTok owner ByteDance will face a potential fine as soon as next week from Ireland’s Data Protection Commission following an investigation into possible transfers of users’ data to China, a commissioner at the authority told MLex.“TikTok will be in the next few weeks,” Des Hogan, commissioner at the Irish Data Protection Commission, told MLex in an interview on the sidelines of a conference* in Washington.
Hogan said that the Irish DPC has sent the draft decision to other data protection authorities in the 27-nation EU and hasn’t received any objections.
Under the EU General Data Protection Regulation’s Article 60 procedure, other “concerned” supervisory authorities have four weeks to present their views. These watchdogs can state “a relevant and reasoned objection” to any part of the decision.
Hogan said the authority needs to review submissions. “We're coming out of the Article 60 process,” he said.
It’s not known how much ByteDance might be fined, but the company has put aside more than $1 billion for potential fallout from regulatory, privacy and consumer actions in Europe, financial results in October 2024 show (see here). Bloomberg News reported earlier this month that the fine would be more than 500 million euros.
A decision against ByteDance would come after increased scrutiny of its social media app TikTok. In January, privacy advocacy group NOYB filed complaints against TikTok, AliExpress, Shein, Temu, WeChat and Xiaomi for alleged unlawful data transfers to China (see here).
The Irish investigation began in 2021 and focuses on possible transfers by TikTok of personal data to China and TikTok’s compliance with the EU data protection rules’ requirements for transfers of personal data to third countries (see here).
A decision against TikTok would follow several years of governments and privacy advocates’ concerns that the Chinese government could access data on individual users through TikTok.
Under the GDPR, data transfers outside the EU are only allowed if the destination country provides “adequate” protection of European citizens’ personal data.
In 2023, the company was fined 345 million euros (about $393 million) by the Irish DPC for child data violations (see here).
A TikTok spokesperson had no comment.
* IAPP Global Privacy Summit 2025, Washington, DC, April 22-24, 2025.
Please email editors@mlex.com to contact the editorial staff regarding this story, or to submit the names of lawyers and advisers.