[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fJCCYkLB0BL7WylZoe_exg5yVGw7TPx-LW_32R2EGApY":3},{"article":4,"iocs":43,"watch_terms":44,"solutions":45,"lesson":132},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":20,"category":21,"article_tags":25},"79e28738-3d5c-4aab-917e-148b3bcde76e","High Court - TikTok Technology Limited v Data Protection Commission (2026) IEHC 347","high-court-tiktok-technology-limited-v-data-protection-commission-2026-iehc-347-134aec","← Older revision Revision as of 09:26, 24 June 2026 Line 12: Line 12: |ECLI= |ECLI= |Original_Source_Name_1= |Original_Source_Name_1=Bailii |Original_Source_Link_1=https:\u002F\u002Fmedia.licdn.com\u002Fdms\u002Fdocument\u002Fmedia\u002Fv2\u002FD4E1FAQEu5NQOLfg3Uw\u002Ffeedshare-document-pdf-analyzed\u002FB4EZ64ivSAJYAY-\u002F0\u002F1781212581102?e=1782345600&v=beta&t=KhMCakoA-T4ShUP4nmpz46xGWizXu_iZxQuC21whW9E |Original_Source_Link_1=https:\u002F\u002Fmedia.licdn.com\u002Fdms\u002Fdocument\u002Fmedia\u002Fv2\u002FD4E1FAQEu5NQOLfg3Uw\u002Ffeedshare-document-pdf-analyzed\u002FB4EZ64ivSAJYAY-\u002F0\u002F1781212581102?e=1782345600&v=beta&t=KhMCakoA-T4ShUP4nmpz46xGWizXu_iZxQuC21whW9E |Original_Source_Language_1=English |Original_Source_Language_1=English","The Irish High Court has partially overturned a decision against TikTok Technology Limited regarding unlawful data transfers to China. While the court upheld the Data Protection Commission's (DPC) finding that TikTok unlawfully transferred EEA user data to China, it revoked the transfer ban. This revocation was based on the DPC's failure to adequately assess technical changes made by TikTok, including Project Clover, which aimed to localize data and restrict access from China.","High Court revokes TikTok's data transfer ban to China but upholds DPC's finding of unlawful transfer.","https:\u002F\u002Fgdprhub.eu\u002Findex.php?title=High_Court_-_TikTok_Technology_Limited_v_Data_Protection_Commission_(2026)_IEHC_347&diff=51984&oldid=51909","https:\u002F\u002Fgdprhub.eu\u002Fimages\u002F4\u002F4c\u002FCourts_logo1.png","2026-06-24T09:26:28+00:00","2026-06-24T10:00:13.856115+00:00",7,[17],{"name":18,"type":19},"TikTok","vendor","c5c77cdb-f7d7-4990-9436-c81dcbff1163",{"id":20,"icon":22,"name":23,"slug":24},null,"Policy","policy",[26,31,36,38],{"category":27},{"id":28,"icon":22,"name":29,"slug":30},"3f0f8451-91df-4b6c-9a73-ef3b2509b7f1","GDPR","gdpr",{"category":32},{"id":33,"icon":22,"name":34,"slug":35},"53f9c4b6-8bc6-4964-9169-d09e5cd41d72","Compliance","compliance",{"category":37},{"id":20,"icon":22,"name":23,"slug":24},{"category":39},{"id":40,"icon":22,"name":41,"slug":42},"d95477d7-eb04-4fad-a2dc-be1428040ce7","Privacy Fines","privacy-fines",[],[18],{"controls":46,"vendors":131},[47,76,102],{"slug":48,"name":49,"problem":50,"products":51},"cloud-security-posture","Cloud security posture management (CSPM and CNAPP)","Misconfigured cloud storage and over-permissive roles get caught before they leak.",[52,60,68],{"vendor_slug":53,"vendor_name":54,"vendor_logo":55,"product_slug":56,"product_name":57,"url":58,"description":59},"orca-security","Orca Security","\u002Fvendor-logos\u002Forca-security.png","orca-cloud-security-platform","Orca Cloud Security Platform","https:\u002F\u002Forca.security\u002Fplatform\u002F","Agentless cloud security platform for posture, vulnerabilities and data exposure.",{"vendor_slug":61,"vendor_name":62,"vendor_logo":63,"product_slug":64,"product_name":65,"url":66,"description":67},"microsoft","Microsoft","\u002Fvendor-logos\u002Fmicrosoft.png","defender-for-cloud","Microsoft Defender for Cloud","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fcloud-security\u002Fmicrosoft-defender-cloud","Cloud posture management and workload protection for Azure, AWS and Google Cloud.",{"vendor_slug":69,"vendor_name":70,"vendor_logo":71,"product_slug":72,"product_name":73,"url":74,"description":75},"wiz","Wiz","\u002Fvendor-logos\u002Fwiz.png","wiz-cloud","Wiz Cloud","https:\u002F\u002Fwww.wiz.io\u002Fplatform\u002Fwiz-cloud","Agentless cloud security posture and attack path analysis across major cloud providers.",{"slug":77,"name":78,"problem":79,"products":80},"data-loss-prevention","Data loss prevention (DLP)","Sensitive data cannot quietly leave by email, upload, USB stick or AI tool.",[81,89,97],{"vendor_slug":82,"vendor_name":83,"vendor_logo":84,"product_slug":85,"product_name":86,"url":87,"description":88},"proofpoint","Proofpoint","\u002Fvendor-logos\u002Fproofpoint.png","enterprise-dlp","Proofpoint Enterprise DLP","https:\u002F\u002Fwww.proofpoint.com\u002Fus\u002Fproducts\u002Fdata-loss-prevention","Data loss prevention across email, cloud and endpoints.",{"vendor_slug":90,"vendor_name":91,"vendor_logo":92,"product_slug":93,"product_name":94,"url":95,"description":96},"forcepoint","Forcepoint","\u002Fvendor-logos\u002Fforcepoint.png","forcepoint-dlp","Forcepoint DLP","https:\u002F\u002Fwww.forcepoint.com\u002Fproduct\u002Fdlp-data-loss-prevention","Data loss prevention for endpoints, network, email and cloud applications.",{"vendor_slug":61,"vendor_name":62,"vendor_logo":63,"product_slug":98,"product_name":99,"url":100,"description":101},"purview-dlp","Microsoft Purview Data Loss Prevention","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fdata-security-governance\u002Fmicrosoft-purview-data-security","Data classification and loss prevention across Microsoft 365, endpoints and connected cloud apps.",{"slug":103,"name":104,"problem":105,"products":106},"encryption-key-management","Encryption and key management","Stolen data stays unreadable, and the keys stay under your control.",[107,115,123],{"vendor_slug":108,"vendor_name":109,"vendor_logo":110,"product_slug":111,"product_name":112,"url":113,"description":114},"hashicorp","HashiCorp","\u002Fvendor-logos\u002Fhashicorp.png","vault","HashiCorp Vault","https:\u002F\u002Fwww.hashicorp.com\u002Fen\u002Fproducts\u002Fvault","Secrets management with short-lived credentials and encryption as a service.",{"vendor_slug":116,"vendor_name":117,"vendor_logo":118,"product_slug":119,"product_name":120,"url":121,"description":122},"thales","Thales","\u002Fvendor-logos\u002Fthales.png","luna-hsm","Thales Luna HSM","https:\u002F\u002Fcpl.thalesgroup.com\u002Fencryption\u002Fhardware-security-modules","Hardware security modules for protecting cryptographic keys.",{"vendor_slug":124,"vendor_name":125,"vendor_logo":126,"product_slug":127,"product_name":128,"url":129,"description":130},"utimaco","Utimaco","\u002Fvendor-logos\u002Futimaco.png","utimaco-hsm","Utimaco General Purpose HSM","https:\u002F\u002Futimaco.com\u002Fdata-protection\u002Fgp-hsm","Hardware security modules for key generation, storage and cryptographic operations.",[],{"slug":133,"title":134,"body":135,"framework_refs":136,"framework_notes":149},"tiktoks-data-transfer-case-highlights-regulator-due-diligence-gaps-in-cross-border-data-flows","TikTok's Data Transfer Case Highlights Regulator Due Diligence Gaps in Cross-Border Data Flows","The Irish High Court's ruling illustrates that regulatory enforcement actions must keep pace with technical remediation efforts made by organisations under investigation. TikTok's Project Clover introduced significant architectural changes to localise EEA user data and restrict Chinese access, yet the DPC failed to adequately assess these measures before issuing a blanket transfer ban. This matters because poorly assessed enforcement decisions can be overturned, weakening the deterrent effect of data protection law and eroding public trust. Organisations transferring personal data internationally must not only implement robust technical safeguards but also document and communicate those changes clearly to regulators. Regulators, in turn, must embed technical review processes into enforcement workflows to ensure decisions reflect current operational realities.",[137,138,139,140,141,142,143,144,145,146,147,148],"GDPR Article 44 – General principle for transfers","GDPR Article 46 – Transfers subject to appropriate safeguards","GDPR Article 58 – Powers of supervisory authorities","GDPR Article 30 – Records of processing activities","NIST SP 800-53 AC-20 – Use of external information systems","NIST SP 800-53 SI-12 – Information management and retention","NIST Privacy Framework PR.DS-P5 – Data are protected during transfer","CIS Control 3 – Data Protection","CIS Control 14 – Security Awareness and Skills Training","ISO\u002FIEC 27701 – Privacy Information Management System","ITIL – Change Enablement (ensuring changes are communicated and assessed)","EDPB Recommendations 01\u002F2020 on supplementary measures for data transfers",{}]