Six Chinese companies illegally export data of Europeans to China, the organization claims

Six a Chinese company is accused of illegally exporting the data of European users to China, reports the news agency Reuters.

On Thursday, the non-governmental organization Noyb, which oversees data protection matters, sent complaints to the European authorities about the activities of Tiktok, Xiaomi, Shein, Ali Express, We Chat and Temu.

Companies break Austrian Noyb by EU general data protection regulation GDPR.

It is the first time that Noyb takes Chinese companies into its consideration. In the past, the NGO’s complaints have led to investigations and fines in the EU of major US companies such as Apple, Meta and Google.

Online shopping giant Ali Express, discount clothing store Shein, phone manufacturer Xiaomi and Tikok openly say that they send Europeans’ data to China for storage.

The data of the cheap online store Temu, which has become very popular in Finland, and the chat application We Chat are transferred from the EU to “third countries”. According to Noybi, the information will probably go to China for these as well.

ME:n according to the general data protection regulation, transferring data outside the EU is only permitted when data protection is not impaired when the data changes location.

In China, the authorities have significantly better opportunities to request people’s personal data from companies.

“Given that China is an authoritarian surveillance state, it is crystal clear that China does not offer the same level of data protection as the EU,” says Noybi’s data protection lawyer Kleanthi Sardeli.

“The transfer of Europeans’ personal data is clearly illegal and must be stopped immediately,” he insists in Noybi’s press release.

In addition, Noyb demands fines for companies that can correspond to up to 4 percent of the companies’ global income. For example, in the case of Temu, the maximum fine could be up to 1.35 billion euros.

Correction on January 17 at 20:25: The abbreviation of the European Data Protection Regulation is GDPR (General Data Protection Regulation), not GDRP.