Irish High Court upholds DPC's TikTok decision, orders review of corrective measures

On Thursday, the Irish High Court largely upheld the Irish Data Protection Commission's (DPC) decision against TikTok for violations of Articles 46 and 13 of the EU General Data Protection Regulation (GDPR). The ruling means that the DPC's €530 million in administrative fines remain valid, although the court has indicated that it will consider TikTok's appeal regarding the amount of the fines imposed.

While the court agreed with the DPC that pseudonymised data can still constitute personal data under the GDPR if a person remains identifiable, it disagreed with its conclusions about TikTok's technical measures under 'Project Clover'. The court found that instead of focusing on whether "the data in question can relate to an identifiable person directly or indirectly," it should have addressed "whether, in fact, data subjects can be identified." As a result, the court ruled that the DPC must reconsider its corrective order suspending future transfers to China.

Training Announcement: Freevacy offers a range of independent data protection qualifications from IAPP and BCS. Our certified courses are available at foundation and practitioner levels and cover multiple legal jurisdictions, data protection operations management, and the implementation of complex privacy solutions in technical environments. Find out more.