TikTok challenge to DPC privacy breach finding opens before High Court

High Court reporters

TikTok’s challenge to the Data Protection Commission’s (DPC) finding that the social media giant breached privacy laws in transferring European users’ personal data to China has opened before the High Court.

In April 2025, following a lengthy investigation, the DPC concluded that TikTok breached the EU’s General Data Protection Regulation (GDPR) rules in sending the information to China to be accessed by engineers.

Along with orders directing TikTok to suspend the data transfers and ensure compliance with data privacy laws, the DPC also imposed a fine of €530 million on the company.

In its High Court action, TikTok denies that it breached privacy regulations, and says it believes it has complied with its obligations.

It is not in dispute that certain EU TikTok user data – stored in data centres outside China – can be accessed remotely by China-based personnel.

TikTok also claims, among other things, that the DPC breached fair procedures in arriving at its decision.

TikTok further claims there was an alleged failure to engage with material it put before the DPC – including TikTok’s implementation of a data protection initiative, dubbed Project Clover.

The DPC denies the claims, and is defending the action.

Last November, TikTok succeeded in obtaining a stay on the DPC orders to suspend the data transfers and bring its data processing into compliance with GDPR, pending the outcome of the challenge.

Opening TikTok’s case before Judge Rory Mulcahy on Tuesday, barrister Paul Gallagher submitted that it was necessary for a body such as the DPC – given the powers at its disposal – to have a “heightened sense” of what constitutes fair procedures.

Gallagher described as “misplaced” DPC concerns relating to the purported application of Chinese laws to EU user data access remotely in China, and the potential for Chinese authorities to compel disclosure of the data.

It is TikTok’s position that Chinese authorities do not have jurisdiction to compel disclosure of data stored outside of China.

The hearing is expected to run for 10 days.