The recent fine of approximately R$ 3.4 billion (€345 million) imposed on TikTok by European Union authorities due to the improper transfer of user data to China is an important milestone and represents more than a mere penalty for a tech giant: it is a significant warning to all companies operating with personal data on a global scale.
Although sanctions against large technology companies are no longer new, the recent TikTok case highlights a more rigorous process in the actions of regulatory authorities in response to negligent practices in the handling of personal data, especially when it involves international data transfer to countries that may not offer the same level of legal protection.
For the market, the case brings essential lessons. International transfer of personal data in itself is not a problem, and when carried out properly, it is crucial for the operation of global services in the digital economy era. However, this process must be conducted with safety, transparency, and legal support. The TikTok episode highlights that neglecting these principles can result in serious consequences, not only financial but also reputational damage, risking consumer trust and brand credibility.
More than a legal requirement, respect for privacy and data protection has become a competitive differentiator and a pillar for building trust with users. Companies that handle personal data, especially in global and digital environments, must adopt proactive and robust practices that go beyond minimum compliance with regulations, ensuring not only conformity but also the integration of data protection as a core value of their operations.
In Brazil, the National Data Protection Authority (ANPD) published Resolution CD/ANPD No. 19, dated August 23, 2024, approving the International Data Transfer Regulation and the content of standard contractual clauses, thereby establishing regulatory mechanisms aimed at ensuring the compliance of international transactions, safeguarding personal data in accordance with Brazilian legislation standards. Additionally, the ANPD launched a page about International Data Transfer (TID) at the website:International Affairs – Portuguese — National Data Protection Authority.
*Raissa Dacal and Danielle Campello are, respectively, paralegal and Lawyer specializing in Digital Law, Data Protection, and New Technologies at Di Blasi, Parente & Associates.