Chinese Tech Giants Face EU Privacy Complaints

The Austrian privacy advocacy group noyb (None of Your Business) has filed data privacy complaints against three Chinese tech companies: AliExpress, TikTok, and WeChat. The complaints allege that these companies are not complying with EU data privacy laws, specifically Article 15 of the General Data Protection Regulation (GDPR).

Noyb is known for its previous actions against American tech giants such as Apple, Alphabet, and Meta, which have resulted in several investigations and significant fines. The group's latest complaints were lodged with data protection authorities in Belgium, Greece, and the Netherlands. The primary issue is the companies' alleged refusal to grant users full access to their personal data, as required by EU law.

According to noyb, this refusal is deliberate and keeps European users in the dark about how their data is processed and whether it complies with GDPR provisions, particularly concerning data transfers to China. Most tech companies have tools that allow users to download their information, but some Chinese companies have made it nearly impossible to access this data.

If these companies had implemented automation tools to fulfill GDPR access requests on a mass scale, such as a “download your information” feature, it would hypothetically make compliance with EU law much easier. However, Kleanthi Sardeli, a data protection lawyer at noyb, stated that TikTok, AliExpress, and WeChat enjoy collecting extensive data about their users while keeping them in the dark about its use.

Noyb claims that both TikTok and AliExpress have refused to provide users with access to all of their data as required under Article 15 of the GDPR. TikTok only provided part of the complainant’s data in an unstructured form, making it difficult to understand. AliExpress provided a broken file that could only be opened once, while WeChat completely ignored the complainant’s request.

These actions forced the users to send follow-up questions, giving the companies a second chance to respond. However, instead of supplying the missing data, both TikTok and AliExpress repeated the contents of their privacy policy without providing any individual information. This made it impossible for the complainants to verify whether their data had been processed in line with the GDPR.

These fresh complaints follow earlier actions by noyb against TikTok, AliExpress, SHEIN, Temu, and WeChat in January. The group sought to suspend data transfers to China and called for fines that can reach up to 4% of the offending firms’ global revenue. According to EU law, data transfers outside the EU are only permitted if the destination country does not undermine the protection of data. Since Chinese laws do not limit access to personal data by the authorities, it is not possible for companies to protect EU users’ data from government access.

SHEIN, Temu, and Xiaomi provided the complainants with additional information during the proceedings, but TikTok, AliExpress, and WeChat continued to violate the GDPR. Kleanthi Sardeli emphasized that the GDPR makes it clear that companies must give their users specific information about the data they are processing. Just because they receive a lot of requests doesn’t mean they can withhold information.

The new complaints filed with the data protection authorities (DPAs) in Belgium, Greece, and the Netherlands request that the respective DPAs issue a decision declaring that TikTok, AliExpress, and WeChat have violated Articles 12 and 15 of the GDPR. The group has also requested that the companies be ordered to fulfill the complainants’ access requests and suggested that the DPAs impose an administrative fine to prevent similar violations in the future.