Match Group, the parent company of Tinder, has been fined €11 million because the dating app did not provide users with full copies of the personal data it held about them, even when they asked for it. The decision was announced on Friday, 13 November, by Ireland’s Data Protection Commission (DPC), which found that Tinder had breached the EU’s General Data Protection Regulation (GDPR).
The “Download My Data” tool
The investigation focused on the “Download My Data” feature, through which users can request and download their personal data from the app.
According to the DPC, the tool did not provide all the information users were entitled to receive. Some categories of data were left out entirely, while in other cases the company provided only a summary instead of the full details.
What GDPR requires
The EU regulation gives every citizen the right to know what personal data a company holds about them and to request a copy of it. This means companies cannot decide at will which information to share with users when they exercise their right of access to their data.
The DPC found that the way Tinder operated did not meet these requirements.
The DPC’s position
“Automated access tools can be a useful and effective way for people to obtain their personal data,” said DPC Deputy Commissioner Graham Doyle. He stressed, however, that companies must clearly inform users about the scope of the information they provide.
The investigation began in January 2020 and lasted almost seven years.
Reprimand and three-month deadline
In addition to the €11 million fine, the DPC issued a formal reprimand to Match Group and gave it three months to bring its handling of personal data into line with the GDPR.
Match Group to appeal
The company said it disagrees with the decision and intends to appeal.
“Tinder cooperated with the DPC throughout the investigation and we continue to stand by the privacy protections we have developed for our users,” a Match Group spokesperson said.
No data breach found
The case concerns users’ right to access the information an app collects about them. The DPC did not find a personal data breach. Its finding was that Tinder did not hand over all the information it was required to when users requested it.
With information from Politico
