The Austrian privacy advocacy group noyb (None of Your Business) has reportedly slammed three Chinese tech companies with data privacy complaints for not complying with EU data privacy laws, specifically Article 15 of the GDPR.
Noyb has made a name for itself by filing complaints against American companies like Apple, Alphabet, and Meta, triggering several investigations and billions of dollars in fines.
The advocacy group’s complaints were lodged with data protection authorities in Belgium, Greece, and the Netherlands. Their primary focus is the companies’ alleged refusal to grant users full access to their personal data, as EU law requires.
According to noyb, the refusal is rooted in stubbornness ,which keeps the average European user ignorant of how their data is processed and whether it complies with GDPR provisions, particularly where data transfers to China are concerned.
Most tech companies usually have a tool that allows them to fulfill requests for downloading user information. However, some Chinese companies have made it almost impossible to access the information, noyb has said.
If these Chinese companies had implemented some automation tool that allows them to fulfill GDPR access requests on a mass scale, like via a “download your information” tool, it would hypothetically make it extremely easy for them to comply with EU law.
However, according to Kleanthi Sardeli, data protection lawyer at noyb, TikTok, AliExpress and WeChat all enjoy collecting as much data about their users while keeping them them dark about its use.
Noyb says both TikTok and AliExpress have refused to give the data subjects access to all of their data as required under Article 15 GDPR, with TikTok only providing part of the complainant’s data in an unstructured form that it alleged was hard to grasp.
AliExpress chose to provide a broken file that could be opened only once, while WeChat just completely ignored the complainant’s request.
TikTok and AliExpress’s actions forced the users to send a series of follow-up questions, giving them a second chance to respond.
However, rather than supply the missing data, both companies repeated the contents of their privacy policy without any individual information, making it impossible for the complainants to verify whether their data had been processed in line with the GDPR.
Noyb has been busy this year. The advocacy group reportedly already filed complaints against TikTok, AliExpress, SHEIN, Temu, and WeChat earlier this year in January, seeking to get them to suspend data transfers to China while calling for fines that can reach up to 4% of offending firms’ global revenue.
According to EU law, data transfers outside the EU are only permitted if the destination country doesn’t undermine the protection of data. Since Chinese laws do not limit access to personal data by the authorities, it is not possible for companies to protect EU users’ data from government access.
SHEIN, Temu and Xiaomi reportedly provided the complainants with additional information during the proceedings, but TikTok, AliExpress and WeChat continued to violate the GDPR.
Kleanthi Sardeli, data protection lawyer at noyb said: “The GDPR makes it clear that companies must give their users specific information about the data they are processing about them. Just because they receive a lot of requests doesn’t mean they can withhold information.”
The fresh noyb complaints filed with the data protection authorities (DPAs) in Belgium, Greece and the Netherlands request that the respective DPAs issue a decision declaring that TikTok, AliExpress, and WeChat have violated Article 12 and 15 of the GDPR.
In addition, the group has requested that the companies be ordered to fulfill the complainants’ access requests and suggest that the DPAs impose an administrative fine to prevent similar violations in the future.
KEY Difference Wire helps crypto brands break through and dominate headlines fast