Irish regulator investigates Shein over data transfers to China
Inquiry into Shein’s Data Transfers and Regulatory Context
By Sam Tobin and Padraic Halpin
Overview of the Investigation
DUBLIN, May 5 (Reuters) - Ireland's Data Protection Commission has opened an inquiry into Chinese online retailer Shein over the transfer of European users' data to China, the company's lead EU privacy regulator said on Tuesday.
Scope and Authority of the DPC
The DPC, which has the power to impose heavy fines, will examine and assess the extent to which the company's Europe, Middle East and Africa headquarters in Dublin has complied with its relevant obligations under the EU privacy rules - known as the General Data Protection Regulation, it said in a statement.
GDPR Requirements for Data Transfers
When personal data is transferred to a country outside the EU, GDPR requires that data is given equivalent protections to those it would have within the bloc, according to the regulator.
Precedents and Regulatory Actions
The DPC last year fined China's TikTok 530 million euros ($619 million) over concerns about how it protects user information and ordered the short video platform to suspend data transfers to China unless its processing were made to comply.
"Recent regulatory action by the DPC, together with complaints to other European supervisory authorities, has brought data transfers to China, in particular, into focus," DPC Deputy Commissioner Graham Doyle said in a statement.
He added the inquiry was a strategic priority for the DPC.
Shein’s Response and Commitment to Compliance
Company Statement
SHEIN SAYS IT IS FULLY COMMITTED TO COMPLIANCE
Shein has been "actively engaging with the DPC in recent months on its data protection approach", a Shein spokesperson said in an emailed statement.
"We take our data protection obligations extremely seriously and are fully committed to complying with the GDPR and all applicable data protection laws," the spokesperson said.
Background and Broader Regulatory Landscape
The probe is the first privacy investigation opened into the online retailer since it opened its EMEA headquarters in Dublin in 2023.
The DPC is the lead EU regulator for many of the world's biggest tech firms due to the location of their regional headquarters in Ireland and has levied more than 4 billion euros in fines for GDPR breaches since 2020.
Ongoing Legal Proceedings
An Irish court is due to rule shortly on TikTok's appeal against the DPC's ruling over its data transfers to China. The order to suspend transfers has been paused, pending the outcome.
($1 = 0.8557 euros)
(Reporting by Sam Tobin and Padraic Halpin, additional reporting by Helen Reid; editing by Sarah Young and Barbara Lewis)
