The fine is the result of four years of investigation into the video app's data security and storage of information.
According to the Irish supervisory authority (DPC) that examined the video app on behalf of the EU, Tiktok has now admitted that they have stored European data in China – something they previously denied.
Six months to comply
The fine is the third largest to be imposed by the authority and mainly deals with how to live up to the EU's strict data protection rules.
"Tiktok's transfers of user data to China breached GDPR since they could not confirm, guarantee or show that data from EES users, made available to staff in China, was given the same protection in China as within the EU", writes the authority's spokesperson in the decision.
EES is the EU plus Iceland, Liechtenstein and Norway.
According to the decision, Tiktok must within six months, on the one hand, clarify for users how user data is handled, and on the other hand, confirm that all data transfer to China ceases.
In connection with the investigation, Tiktok confirms for the first time that European data has actually been stored in China. From initially denying it, the company came forward just a week ago with information that a limited amount of data was stored in China during February.
"We acted immediately"
In a statement, Tiktok's spokesperson writes to TT that "our teams discovered the problem themselves thanks to the comprehensive monitoring system that Tiktok has introduced as part of Project Clover. We acted immediately: deleted the data, updated our systems and informed DPC without delay."
Tiktok, owned by the Chinese parent company Bytedance, claims that they will appeal the verdict.
According to the European chief Christine Grahn, Tiktok has never shared – or been asked to share – European user data with Chinese authorities.
