TikTok, AliExpress, SHEIN & Co surrender Europeans’ data to authoritarian China

Data Transfers Today, noyb has filed GDPR complaints against TikTok, AliExpress, SHEIN, Temu, WeChat and Xiaomi for unlawful data transfers to China.

Social Media International Transfer Personal Data Right of Access Procedures Monitoring

Jan 16, 2025Sourcenoyb.eu

Full text

Data Transfers Today, noyb has filed GDPR complaints against TikTok, AliExpress, SHEIN, Temu, WeChat and Xiaomi for unlawful data transfers to China. While four of them openly admit to sending Europeans’ personal data to China, the other two say that they transfer data to undisclosed “third countries”. As none of the companies responded adequately to the complainants’ access requests, we have to assume that this includes China. But EU law is clear: data transfers outside the EU are only allowed if the destination country doesn’t undermine the protection of data. Given that China is an authoritarian surveillance state, companies can’t realistically shield EU users’ data from access by the Chinese government. After issues around US government access, the rise of Chinese apps opens a new front for EU data protection law. Complaint against TikTok in GreeceComplaint against Xiaomi in GreeceComplaint against SHEIN in ItalyComplaint against AliExpress in BelgiumComplaint against WeChat in the

How it connects

Related across sources

C-311/18 C-311/18 - Facebook Ireland and Schrems Maximillian Schrems, an Austrian citizen, had been a Facebook user since 2008. As is the case with users residing in the European Union, some of the data belonging to Mr. Schrems… CJEU Jul 17, 2026 International Transfer Personal Data Controllers

C-311/18 Data Protection Commissioner v Facebook Ireland and Maximillian Schrems C-311/18 (Schrems II) CJEU Jul 16, 2020 Privacy Shield International Transfer IP Address

€100,000 HDPA fines Teleperformance for failing to properly handle employee access request The DPA received a complaint from a former employee of the Service 800 Teleperformance Single Member S.A. (the controller), after the controller failed to comply with the data… Greece ·Art. 5, 12, 13 +3 Personal Data Right of Access Storage Limitation

Opinion 2/2021 EDPB-EDPS Joint Opinion 2/2021 on standard contractual clauses for the transfer of personal data to third countries Adopted 1 EDPB - EDPS Joint Opinion 2 /2021 on the European Commission’s Implementing Decision on standard contractual clauses for the transfer of personal data to third countries… Opinion Jan 14, 2021 International Transfer Personal Data Controllers

Guidelines 05/2021 Interplay between the application of Article 3 and the provisions on international transfers as per Chapter V of the GDPR Guidelines ·EDPB Feb 24, 2023 International Transfer Privacy Shield Controllers

Opinion 31/2021 COLT Group — processor BCRs Spanish SA ·Opinion ·EDPB Aug 5, 2021 International Transfer Supervision Controllers