[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fetSTt_2UxJNfA7M4XcjRA3427JDbEYAB0jVqijVOi7w":3},{"article":4,"iocs":46,"watch_terms":47,"solutions":48,"lesson":123},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":23,"category":24,"article_tags":28},"dc5db124-0fed-4339-9905-3a84ec55174a","High Court - TikTok Technology Limited v Data Protection Commission (2026) IEHC 347","high-court-tiktok-technology-limited-v-data-protection-commission-2026-iehc-347-fa4da2","← Older revision Revision as of 08:52, 17 June 2026 Line 91: Line 91: === Holding === === Holding === The Court largely dismissed the appeal. The Court largely dismissed the appeal. '''Unlawful international transfers to China''' First, the Court upheld the finding that the controller infringed [[Article 46 GDPR#1|Article 46(1) GDPR]]. The Court held that Chapter V GDPR requires a controller transferring personal data to a third country to verify that the data receives a level of protection essentially equivalent to that guaranteed in the EEA. The controller must also be able to demonstrate that assessment, in line with the accountability principle under Articles 5(2) and 24 GDPR. First, the Court upheld the finding that the controller infringed [[Article 46 GDPR#1|Article 46(1) GDPR]]. The Court held that Chapter V GDPR requires a controller transferring personal data to a third country to verify that the data receives a level of protection essentially equivalent to that guaranteed in the EEA. The controller must also be able to demonstrate that assessment, in line with the accountability principle under Articles 5(2) and 24 GDPR. Line 96: Line 98: The Court rejected the controller’s argument that the DPA had reversed the burden of proof. The DPA did not have to prove that Chinese authorities would in fact access the personal data. Rather, the relevant question was whether the controller had adequately verified and demonstrated that the transferred personal data received the required level of protection. The Court rejected the controller’s argument that the DPA had reversed the burden of proof. The DPA did not have to prove that Chinese authorities would in fact access the personal data. Rather, the relevant question was whether the controller had adequately verified and demonstrated that the transferred personal data received the required level of protection. The Court also rejected the controller’s argument that the DPA had misinterpreted Schrems II. According to the Court, the DPA was entitled to assess whether the controller’s verification of the third-country legal framework and supplementary measures was adequate. Since the controller had not properly assessed the position of personal data processed by personnel in China, the DPA was entitled to find an infringement. The Court also rejected the controller’s argument that the DPA had misinterpreted Schrems II. According to the Court, the DPA was entitled to assess whether the controller’s verification of the third-country legal framework and supplementary measures was adequate. Since the controller had not properly assessed the position of personal data processed by personnel in China, the DPA was entitled to find an infringement. '''Transparency obligations (Article 13(1)(f) GDPR)''' Second, the Court upheld the finding that the controller infringed [[Article 13 GDPR#1f|Article 13(1)(f) GDPR]]. The Court held that the controller’s privacy policy should have identified the third countries to which personal data was transferred, including China. It should also have explained the nature of the processing. The Court considered that the 2021 privacy policy fell short of the GDPR’s transparency requirements. Second, the Court upheld the finding that the controller infringed [[Article 13 GDPR#1f|Article 13(1)(f) GDPR]]. The Court held that the controller’s privacy policy should have identified the third countries to which personal data was transferred, including China. It should also have explained the nature of the processing. The Court considered that the 2021 privacy policy fell short of the GDPR’s transparency requirements. '''Negligence and entitlement to impose fines (Article 83 GDPR)''' Third, the Court upheld the DPA’s conclusion that the infringements were negligent under [[Article 83 GDPR#2b|Article 83(2)(b) GDPR]]. The controller failed to comply with an obvious obligation under [[Article 46 GDPR#1|Article 46(1) GDPR]] and did not justify its misunderstanding of its obligations under [[Article 13 GDPR#1f|Article 13(1)(f) GDPR]]. Therefore, the DPA was entitled to impose administrative fines. However, the Court left the controller’s appeal against the amount of the fines for a later judgment. Third, the Court upheld the DPA’s conclusion that the infringements were negligent under [[Article 83 GDPR#2b|Article 83(2)(b) GDPR]]. The controller failed to comply with an obvious obligation under [[Article 46 GDPR#1|Article 46(1) GDPR]] and did not justify its misunderstanding of its obligations under [[Article 13 GDPR#1f|Article 13(1)(f) GDPR]]. Therefore, the DPA was entitled to impose administrative fines. However, the Court left the controller’s appeal against the amount of the fines for a later judgment. '''Corrective measures''' Fourth, the Court assessed the corrective orders. It held that the DPA had not erred in law by considering whether a suspension order and processing order were necessary, appropriate and proportionate. The DPA was not required to make a further infringement finding before adopting corrective orders. Fourth, the Court assessed the corrective orders. It held that the DPA had not erred in law by considering whether a suspension order and processing order were necessary, appropriate and proportionate. The DPA was not required to make a further infringement finding before adopting corrective orders. Line 106: Line 114: The Court held that the DPA had not sufficiently explained why the controller’s pseudonymisation and differential privacy measures were ineffective, or why they did not affect the need for a suspension order. In particular, the DPA had not properly assessed whether EEA users remained identifiable in the data still accessible by China-based personnel under Project Clover. The Court noted that pseudonymised data is not automatically non-personal data, but it is also not necessarily personal data in every context. This required a reasoned assessment. The Court held that the DPA had not sufficiently explained why the controller’s pseudonymisation and differential privacy measures were ineffective, or why they did not affect the need for a suspension order. In particular, the DPA had not properly assessed whether EEA users remained identifiable in the data still accessible by China-based personnel under Project Clover. The Court noted that pseudonymised data is not automatically non-personal data, but it is also not necessarily personal data in every context. This required a reasoned assessment. '''Outcome''' The Court therefore upheld the finding that the controller’s transfers to China were unlawful under [[Article 46 GDPR#1|Article 46(1) GDPR]] and confirmed that the DPA was entitled to impose administrative fines. However, it vacated the DPA’s order requiring the suspension of the transfers, as well as the related processing order. The matter was remitted to the DPA, which must reassess whether corrective measures remain necessary and proportionate in light of Project Clover and the other later evidence. The Court therefore upheld the finding that the controller’s transfers to China were unlawful under [[Article 46 GDPR#1|Article 46(1) GDPR]] and confirmed that the DPA was entitled to impose administrative fines. However, it vacated the DPA’s order requiring the suspension of the transfers, as well as the related processing order. The matter was remitted to the DPA, which must reassess whether corrective measures remain necessary and proportionate in light of Project Clover and the other later evidence.","The Irish High Court largely dismissed TikTok Technology Limited's appeal against the Data Protection Commission (DPC). The court upheld the finding that TikTok infringed Article 46(1) GDPR by unlawfully transferring personal data to China, as the company failed to adequately verify the level of protection afforded to the data. The court also found TikTok infringed transparency obligations under Article 13(1)(f) GDPR for not properly identifying data transfer destinations and processing nature in its privacy policy. While the court confirmed the DPC's entitlement to impose fines, it vacated the order suspending data transfers, remitting the matter for reassessment.","High Court upholds finding that TikTok's international data transfers to China were unlawful under GDPR.","https:\u002F\u002Fgdprhub.eu\u002Findex.php?title=High_Court_-_TikTok_Technology_Limited_v_Data_Protection_Commission_(2026)_IEHC_347&diff=51909&oldid=51904","https:\u002F\u002Fgdprhub.eu\u002Fimages\u002F4\u002F4c\u002FCourts_logo1.png","2026-06-17T08:52:45+00:00","2026-06-17T10:00:11.63713+00:00",7,[17,20],{"name":18,"type":19},"TikTok","product",{"name":21,"type":22},"TikTok Technology Limited","vendor","c5c77cdb-f7d7-4990-9436-c81dcbff1163",{"id":23,"icon":25,"name":26,"slug":27},null,"Policy","policy",[29,34,39,44],{"category":30},{"id":31,"icon":25,"name":32,"slug":33},"3f0f8451-91df-4b6c-9a73-ef3b2509b7f1","GDPR","gdpr",{"category":35},{"id":36,"icon":25,"name":37,"slug":38},"53f9c4b6-8bc6-4964-9169-d09e5cd41d72","Compliance","compliance",{"category":40},{"id":41,"icon":25,"name":42,"slug":43},"614132b8-5837-4952-b8b5-c6c9a32a1d85","Privacy","privacy",{"category":45},{"id":23,"icon":25,"name":26,"slug":27},[],[21],{"controls":49,"vendors":122},[50,79,105],{"slug":51,"name":52,"problem":53,"products":54},"data-loss-prevention","Data loss prevention (DLP)","Sensitive data cannot quietly leave by email, upload, USB stick or AI tool.",[55,63,71],{"vendor_slug":56,"vendor_name":57,"vendor_logo":58,"product_slug":59,"product_name":60,"url":61,"description":62},"proofpoint","Proofpoint","\u002Fvendor-logos\u002Fproofpoint.png","enterprise-dlp","Proofpoint Enterprise DLP","https:\u002F\u002Fwww.proofpoint.com\u002Fus\u002Fproducts\u002Fdata-loss-prevention","Data loss prevention across email, cloud and endpoints.",{"vendor_slug":64,"vendor_name":65,"vendor_logo":66,"product_slug":67,"product_name":68,"url":69,"description":70},"netskope","Netskope","\u002Fvendor-logos\u002Fnetskope.png","netskope-dlp","Netskope DLP","https:\u002F\u002Fwww.netskope.com\u002Fproducts\u002Fdata-loss-prevention","Data loss prevention for web, cloud apps, AI tools and endpoints.",{"vendor_slug":72,"vendor_name":73,"vendor_logo":74,"product_slug":75,"product_name":76,"url":77,"description":78},"forcepoint","Forcepoint","\u002Fvendor-logos\u002Fforcepoint.png","forcepoint-dlp","Forcepoint DLP","https:\u002F\u002Fwww.forcepoint.com\u002Fproduct\u002Fdlp-data-loss-prevention","Data loss prevention for endpoints, network, email and cloud applications.",{"slug":80,"name":81,"problem":82,"products":83},"encryption-key-management","Encryption and key management","Stolen data stays unreadable, and the keys stay under your control.",[84,92,100],{"vendor_slug":85,"vendor_name":86,"vendor_logo":87,"product_slug":88,"product_name":89,"url":90,"description":91},"hashicorp","HashiCorp","\u002Fvendor-logos\u002Fhashicorp.png","vault","HashiCorp Vault","https:\u002F\u002Fwww.hashicorp.com\u002Fen\u002Fproducts\u002Fvault","Secrets management with short-lived credentials and encryption as a service.",{"vendor_slug":93,"vendor_name":94,"vendor_logo":95,"product_slug":96,"product_name":97,"url":98,"description":99},"thales","Thales","\u002Fvendor-logos\u002Fthales.png","ciphertrust","CipherTrust Data Security Platform","https:\u002F\u002Fcpl.thalesgroup.com\u002Fencryption\u002Fdata-security-platform","Data discovery, encryption and central key management across on-premises and cloud.",{"vendor_slug":93,"vendor_name":94,"vendor_logo":95,"product_slug":101,"product_name":102,"url":103,"description":104},"luna-hsm","Thales Luna HSM","https:\u002F\u002Fcpl.thalesgroup.com\u002Fencryption\u002Fhardware-security-modules","Hardware security modules for protecting cryptographic keys.",{"slug":106,"name":107,"problem":108,"products":109},"compliance-automation","Compliance automation (GRC)","Evidence for NIS2, DORA and ISO 27001 is collected continuously, not in a rush before the audit.",[110,116],{"vendor_slug":111,"vendor_name":112,"vendor_logo":113,"product_slug":111,"product_name":112,"url":114,"description":115},"vanta","Vanta","\u002Fvendor-logos\u002Fvanta.png","https:\u002F\u002Fwww.vanta.com\u002F","Automated evidence collection and continuous monitoring for ISO 27001, SOC 2, NIS2 and other frameworks.",{"vendor_slug":117,"vendor_name":118,"vendor_logo":119,"product_slug":117,"product_name":118,"url":120,"description":121},"drata","Drata","\u002Fvendor-logos\u002Fdrata.png","https:\u002F\u002Fdrata.com\u002F","Continuous control monitoring and audit readiness across security frameworks.",[],{"slug":124,"title":125,"body":126,"framework_refs":127,"framework_notes":138},"tiktok-fined-for-unlawful-gdpr-data-transfers-to-china-and-opaque-privacy-policy","TikTok Fined for Unlawful GDPR Data Transfers to China and Opaque Privacy Policy","TikTok failed to adequately verify that personal data transferred to China received a level of protection equivalent to that guaranteed under EU law, violating Article 46(1) GDPR's requirements for lawful third-country data transfers. Compounding this, TikTok's privacy policy did not clearly identify data transfer destinations or the nature of processing, breaching Article 13(1)(f) transparency obligations. This case underscores that organisations cannot treat data transfer mechanisms as a checkbox exercise — they must actively and continuously validate the protections in place in destination countries. The ruling matters beyond TikTok: any organisation routing EU personal data to jurisdictions without an adequacy decision must maintain robust, documented Transfer Impact Assessments (TIAs) or face significant regulatory and reputational consequences.",[128,129,130,131,132,133,134,135,136,137],"GDPR Article 46(1) — Transfers subject to appropriate safeguards","GDPR Article 13(1)(f) — Transparency obligations at time of data collection","GDPR Article 44 — General principle for transfers to third countries","GDPR Article 30 — Records of Processing Activities (RoPA)","EDPB Recommendations 01\u002F2020 on Transfer Impact Assessments","NIST Privacy Framework PR.DS-P1 — Data processing transparency","NIST SP 800-53 PT-7 — Specific Categories of Personally Identifiable Information","CIS Control 3 — Data Protection","ISO\u002FIEC 27701:2019 — Privacy Information Management (PIMS)","ITIL Service Management — Supplier and contract management for third-party risk",{}]