In a significant move to safeguard European Union (EU) data privacy, the Austrian advocacy group Noyb has filed formal complaints against six prominent Chinese companies. Among those targeted are TikTok, Shein, Xiaomi, Temu, AliExpress, and WeChat. These complaints allege that the companies are unlawfully transferring the personal data of EU users to China in violation of the General Data Protection Regulation (GDPR). This legal action underscores growing anxieties about data security and the influence of foreign surveillance in today’s interconnected digital world.

The Core of the Complaints

Noyb—short for “None of Your Business”—has built a reputation for challenging tech giants over privacy concerns. Previously, the Vienna-based group has filed complaints against major American corporations, including Apple, Alphabet, and Meta, leading to investigations and substantial fines. This latest campaign marks the organization’s first major effort to hold Chinese firms accountable for their handling of EU user data.

The group has submitted six complaints in Austria, Belgium, Greece, Italy, and the Netherlands. It is demanding the immediate cessation of data transfers to China and calling for fines that could reach up to 4% of the companies’ global annual revenue. According to Noyb, four of the accused firms—TikTok, AliExpress, Shein, and Xiaomi—explicitly state in their policies that they send user data to China. Meanwhile, Temu and Tencent’s WeChat reportedly transfer data to unspecified “third countries,” which Noyb strongly suspects includes China.

Why These Transfers Violate GDPR

The GDPR is a cornerstone of EU data privacy law, setting strict conditions for transferring personal data outside the EU. Such transfers are permissible only if the receiving country provides a level of data protection comparable to that of the EU. Noyb argues that China’s status as an “authoritarian surveillance state” makes it impossible for the country to meet these standards.

Kleanthi Sardeli, a data protection lawyer with Noyb, emphasized the gravity of the situation: “Given that China is an authoritarian surveillance state, it is crystal clear that China doesn’t offer the same level of data protection as the EU. Transferring Europeans’ personal data is clearly unlawful—and must be terminated immediately.”

Noyb’s investigation is supported by transparency reports and other documents provided by the companies themselves. These materials indicate that user data is being sent to China, raising serious questions about compliance with EU regulations.

Noyb relied on the companies’ own transparency reports and public statements to build its case. These documents revealed that the firms were transferring data outside the EU, often without adequately disclosing the destination or providing assurances about data protection. By filing public complaints, Noyb aims not only to halt these practices but also to set a legal precedent for future cases involving similar breaches.

The Chinese government has denied any wrongdoing, asserting that it does not compel companies to violate local laws in their handling of foreign data. A spokesperson for China’s Ministry of Foreign Affairs stated, “The Chinese government has never and will never ask enterprises or individuals to collect or provide data information and intelligence located in foreign countries for the Chinese government in a manner that violates local laws.”

Among the companies named, Xiaomi has responded to the allegations, stating that it is “examining the allegations” and will fully cooperate with authorities if approached. However, the other five companies have yet to release public statements addressing the complaints.

This case represents a pivotal moment in the ongoing debate over data privacy and global surveillance. Chinese firms, particularly ByteDance-owned TikTok, have faced growing scrutiny in recent years. TikTok is currently embroiled in regulatory challenges in both the United States and Europe. The European Commission, for example, is investigating the platform for its suspected failure to limit election interference, notably during the Romanian presidential elections in November.

Noyb’s complaints seek to underscore the importance of adhering to GDPR standards, particularly as concerns mount over the influence of foreign governments on personal data security. The potential penalties—including fines of up to 4% of a company’s global revenue—could serve as a stark warning to other international firms operating in the EU.

“These cases are about more than just legal violations,” Sardeli noted. “They’re about ensuring that people’s personal data is treated with the respect and care that EU law demands.”

ACZ Editor: We have no doubt that Chinese intelligence collects data for various kinds of leverage, including information about our children. Their ethical standards allow them to use information any way that gives them power and influence.