TikTok and Five Other Chinese Companies Accused of Breaching GDPR

noyb, a well-known non-profit from Europe focused on protecting digital rights under GDPR and the ePrivacy Directive, has filed complaints against TikTok, AliExpress, SHEIN, Temu, WeChat and Xiaomi.

One essential tenet of GDPR relates to the usage of data and its transfer outside of the European Union. This practice is not permitted, with very few exceptions. The current complaints arise because Chinese companies find themselves in a situation in which it’s impossible for them to guarantee the security of that information. 

“While four of them openly admit to sending Europeans’ personal data to China, the other two say that they transfer data to undisclosed ‘third countries’,” explains the non-profit organization. “As none of the companies responded adequately to the complainants’ access requests, we have to assume that this includes China.”

 “Given that China is an authoritarian surveillance state, companies can’t realistically shield EU users’ data from access by the Chinese government,” underlined noyb in the announcement. 

The NGO gives the example of Xiaomi, which often lets Chinese authorities access personal data on a very large scale. Of course, such requests exist in Europe too, but they are rare and not as broad in scope.

Moreover, foreign users can’t exercise their rights under Chinese data protection law because the country has no dedicated authority that can respond to any requests. 

“noyb has now filed 6 GDPR complaints in 5 European countries and requests the data protection authorities to immediately order the suspension of data transfers to China under Article 58(2)(j) as the country does not provide an essentially equivalent level of data protection under Article 44 and 46 GDPR,” the NGO explained. 

The organization requests that all of these companies comply with GDPR and that data protection agencies issue fines of up to 4% of global revenue. 

noyb has had a lot of success in the past, going after companies such as Mozilla, X (formerly Twitter), Netflix, and even the EU Parliament itself.