Irish privacy watchdog hits TikTok with €530M fine over data transfers to China

And in terms of jurisdiction - it's a bit like you visiting Ireland on holiday and committing a crime - and then arguing they have no jurisdiction over you as you are only there for 2 weeks.

The law does say global revenues, and I think that is a deterrent to treating fines as just a cost of doing business.

If you do business in Europe, there's a bunch of (good!) privacy regulations you have to comply with. One of these is that you're not allowed to transfer the data to a jurisdiction that doesn't follow equivalent protections to the GDPR[0]. TikTok transferred European user data to their Chinese servers, which is a pretty obvious no-go, since the Chinese government is an authoritarian watchdog that inherently can't guarantee these protections (as the GDPR also applies to transferring data to the government.)

Ireland has jurisdiction because the EU offers something called the "one stop shop" concept, where a foreign company can declare that they have EU headquarters in a specific member state, and from that point on the only EU regulations they have to directly worry about are how they're implemented in that country in specific[1]. Every major tech company is therefore in Ireland because the country is small enough to essentially steamroll local politicians with lobby money, leading to very lax enforcement until the EU starts applying pressure.[2]

[0]: This also causes issues with data transfers to the US, and in the most extreme interpretation, makes it so that you probably can't do business with both Europe and the US at the same time in the first place. This is because of the CLOUD act, which goes across jurisdictions and is something the US government can use to compel any service provider to hand over data.

[1]: Of course, a country can still have it's own laws that a company can run afoul of on top of that.

[2]: Other countries with this issue are Luxembourg (Fintech companies love Luxembourg because they can just hire all the good lawyers, meaning you can't negotiate legal disputes there effectively) and the Netherlands (which is a EU-based tax haven for large corporations that aren't in either sector.)

How much value did tiktok derive from flaunting these privacy laws? It's not entirely unlikely that it was less than 530M€.

If their global revenue was $1000, and the local revenue is $1, fining them $0.10 isn't going to help much.

And yes, everything a multi-billion dollar company does is indeed the government's business - and the people's business. We have a right to regulate them as we see fit.

> The Irish national watchdog serves as TikTok’s lead data privacy regulator in the 27-nation EU because the company’s European headquarters is based in Dublin.

This is likely under the GDPR, whose penalties are based on global revenue. If TikTok doesn't like it, it is of course free to cease activity in Europe (strictly speaking the GDPR also protects European citizens outside of Europe, but in practice if a company doesn't operate in Europe there is little that the EU can do).

And you can't really just look at the 3%, you have to factor in what benefits (money, political sway, whatever) they received in exchange for the data. For simplicity, if they got paid, I don't know, $150M/yr from China for the data and they've been sending data for (at least) 4 years... They would have made a profit despite the fine!

($150M is obviously pulled out of my ass, just as a demonstration of how when you look at the fines from a bigger context, it might just be a line item on the expense report that's worth taking the risk on)

To someone on $500k a year, $1k is a night out in vegas.

To a billionaire, $1k is toilet paper.

[0]: https://www.barrons.com/articles/trump-campaign-donations-ti...

[1]: https://www.msnbc.com/the-reidout/reidout-blog/tiktok-ceo-tr...

[2]: https://mezha.media/en/2025/01/17/tiktok-to-be-the-main-spon...

Seems pretty dumb if you're a Chinese Propaganda wings to fund foreign political opponents who literally want your society to fail. But I guess if Western Intelligence sources tell you they are a propaganda wing IT MUST BE TRUE!

This is explicitly not a concern under GDPR. The "one-stop shop" mechanism means that all issues across the EU get funneled to the lead supervisory authority, which is always Ireland because that's where EU subsidiaries are headquarters for tax purposes.

Nah, hollywood accounting is alive and well in tech. Especially in Ireland, where plenty of tech companies are being "charged" slightly absurd fees for services or trademark licenses by subsidiaries or parents in other countries to avoid making a profit on their tax filings.

> simply bankrupt a corporation, which is not what you want if your goal is to change behavior.

Yes it is. Nuke the corporation and burn all the investors. This will teach a lesson.

Companies don't protect user data. They store, silo, and secure user data for as little cost as possible. No meaningful consequences means they will continue to harvest and disperse user data at an increasing rate until we get serious about requiring responsible practices and accountability.

The risk of being bankrupted is what will keep a corporation behaving well.

Penalties should be fatal to a corporation. If Microsoft or some random new startup had to follow the same regulations and protect user data to some bare minimum standard, and we apply the same degree of penalty, rather than some arbitrarily large fine which the mega corps are happy to pay, we can affect behavior.

The big companies have teams of lawyers who effectively (and sometimes explicitly) collude with the beancounters and MBAs to enshittify their products and services and milk every last drop of revenue, even exploiting the data of non-customers who just happened to encounter some peripheral surveillance apparatus.

We need to protect individual data privacy and restrict anything except informed consensual tracking. We need to mandate ephemerality and basic security standards. We need to make violations of these regulations lethal to a company, and impose mandatory minimum jail time for c-suite offenders.

Anything short of this results in overt, blatant, repeated violations of the laws by the big companies because they're happy to pay $5m or even $50m if it means they extract $500m more revenue and lock out any potential disruptive competition.

This would effectively mean that giant platforms which cannot responsibly store and manage user data would not be able to continue operation at the scale they're at. It would mean fragmentation and decentralization of various services, disincentivizing monopoly, improving market health, driving product and service progress.

Without harsh and extreme consequences that are as meaningfully painful to FAANG sized megacorps as they are to a one man startup, the problems won't ever be resolved. FAANG and tech outpaced regulation, resulting in effectively the total pwnage of data for more or less every living human on the planet. This is unacceptable, and the only way it changes is for the US to drop the hammer on the exploitive and irresponsible practices that led us here.

Let these asshats go bankrupt. We don't need Meta or Alphabet or Amazon. They're not entitled to screw the world for profit. If they can't operate ethically and responsibly, then they shouldn't be allowed to operate at all.

Finland for example will fine you 100k for speeding if your income is high enough. In the UK fines range from 50% of your weekly income (band A) to 600% of your weekly income. Someone on £500 a week income and spending that on housing, food etc, could pay £3k. Someone with the same offence on £50k a week would be fined £300k.

If a company is taking £billion out of a nation's spending power, and doing so with nefarious practices, that's what should be fined.

If bankruptcy is a worry, then comapnies shouldn't fly so close to the sun when adopting immoral practices.

Income is the only reliable thing you can tax. Trying to calculate profit for international companies is an absolute joke which is massively inefficient. Why an Earth should governments employ entire teams to second guess internal bookkeeping?

If you want to take a billion from a nation's citizens, better be sure you're providing a legal service. I mean, are drug dealers punished on profit?

This is the equivalent of the famous Babbage anecdote, but for the law. That's absolutely not how the law or regulatory compliance works, not in Europe at least.

> Placement of the sign varies. Countries have generally continued the style used for their former currencies. In those countries where previous convention was to place the currency sign before the figure, the euro sign is placed in the same position (e.g., €3.50).[7] In those countries where the amount preceded the national currency sign, the euro sign is again placed in that relative position (e.g., 3,50 €).

> In English, the euro sign – like the dollar sign ⟨$⟩ and the pound sign ⟨£⟩ – is usually placed before the figure, unspaced,[8] the reverse of usage in many other European languages

> The European Union's Interinstitutional Style Guide (for EU staff) states that the euro sign should be placed in front of the amount without any space in English, but after the amount in most other languages

https://en.wikipedia.org/wiki/Euro_sign#Use

For example, in German it's usually written postfix, but in Dutch it's usually prefix.

The verdict is for the entire EU, they'd have to exit the EU market.

Meanwhile this is a very interesting read on their corporate structure: https://committees.parliament.uk/writtenevidence/13247/defau...

"On corporate structure specifically, there is a misconception that TikTok UK is a subsidiary of ByteDance's operations in China. This is not the case. TikTok UK is owned by global parent company ByteDance Ltd, incorporated in the Cayman Islands"

.. now, everyone talks about China as a global enemy of freedom and accountability, but I think Grand Cayman is underestimated as a bad actor or protector thereof.

Don't know specifically about this scenario, but I've never seen a government's general revenues account treated like this. Governments rarely pay "dividends" - unless you're a targeted voting block they decide to go after.

This seems to be a fine issued in the Republic of Ireland which is not part of the UK (but, unlike the UK, is still part of the EU).

We need services that respect user privacy and are not a longterm security threat.

Fine by me! Especially FB.

[0] https://en.wikipedia.org/wiki/Betteridge%27s_law_of_headline...

> The IDPC issued an administrative fine of EUR €1.2 billion as well as corrective orders requiring Meta Platforms Ireland to suspend the relevant transfers and to bring its processing operations into compliance with Chapter V GDPR by ceasing the unlawful processing, including storage, of such data in the United States. We are appealing this Final Decision and it is currently subject to an interim stay from the Irish High Court.

https://www.sec.gov/Archives/edgar/data/1326801/000132680125...