{"type":"rich","version":"1.0","provider_name":"Transistor","provider_url":"https://transistor.fm","author_name":"Daily Security Review","title":"TikTok, China, and the EU: The Battle Over Data Sovereignty","html":"<iframe width=\"100%\" height=\"180\" frameborder=\"no\" scrolling=\"no\" seamless src=\"https://share.transistor.fm/e/40a1d9fb\"></iframe>","width":"100%","height":180,"duration":3486,"description":"In this episode, we explore the mounting scrutiny TikTok faces over its handling of European user data, with the EU’s Data Protection Commission (DPC) launching a fresh investigation into alleged transfers of data to China. TikTok, owned by Beijing-based ByteDance, is once again in the crosshairs for possible violations of the General Data Protection Regulation (GDPR) — this time following revelations that contradicted previous assurances given during a years-long inquiry.\nAt the heart of the episode lies the broader question: Who controls data in a globalized, politically fractured internet?\nWe delve into the intricate politics of data localization, examining how governments are increasingly treating data flows as matters of sovereignty and national security. With the EU enforcing a rights-based data protection regime and China emphasizing state-centric control through its Personal Information Protection Law (PIPL), companies like TikTok are navigating a legal minefield where compliance in one jurisdiction could mean noncompliance in another.\nTopics discussed include:\nTikTok’s €530 million GDPR fine and the new inquiry sparked by undisclosed data transfers to Chinese servers.\nThe role of Project Clover, TikTok’s €12 billion initiative to localize EU user data and build trust through European-based infrastructure and security auditing.\nHow GDPR’s Article 46 requires equivalency in legal safeguards for any cross-border data transfers, and why Chinese laws such as the National Intelligence Law fail that test.\nThe strategic enforcement power of the Irish DPC and how remote access, not just physical storage, is now classified as a “data transfer” under GDPR.\nThe stark contrast between GDPR and China’s PIPL: one centers on individual rights and transparency, while the other prioritizes state surveillance and geopolitical control.\nThe collateral damage to global cloud computing, API efficiency, and data redundancy when localization laws fragment digital ecosystems....","thumbnail_url":"https://img.transistorcdn.com/pL79_MJFeJHamQ_ztImsGmDSMdl27VMk_30TAkieujE/rs:fill:0:0:1/w:400/h:400/q:60/mb:500000/aHR0cHM6Ly9pbWct/dXBsb2FkLXByb2R1/Y3Rpb24udHJhbnNp/c3Rvci5mbS8yNzg5/ZjlhNzM5Y2M4Njli/NjkxNzgyODA2Nzhi/MDI2ZC5wbmc.webp","thumbnail_width":300,"thumbnail_height":300}