Tinder fined 11 million for irregularities with personal data

A Ireland Data Protection Commission (DPC), one of the leading regulators in the EU sector, today reported that it fined Tinder EUR 11 million due to irregularities in users' access to their personal data.

DPC explained that the investigation, initiated in 2020, confirmed that MTCH Technology Services Limited, owner of the popular relationship application, infringed the General Data Protection Regulation (GDPR) of the European Union (EU with regard to users’ rights and obtain a copy of their personal data.

Specifically, the committee examined the operation of the ‘Download My Data’ tool, through which customers could request and download personal information linked to their accounts.

The DPC concluded that this tool did not provide a complete copy of the personal data of users, since certain categories of information were excluded without the owners being informed about it.

In addition, he added that other data were made available only briefly. Therefore, the committee determined that the information provided through this tool did not meet the requirements established by the GDPR regarding the right of access.

In addition to the fine, the company should adjust its data processing operations to ensure compliance with Community rules within three months.

DPC Deputy Commissioner Graham Doyle today said in a statement that “ten thousand users” used the ‘Download My Data’ tool during the period analyzed.

Doyle pointed out that this type of automated tool can facilitate the exercise of rights recognized by the GDPR and allow organizations to manage access requests efficiently.

However, he recalled that, although it is not always necessary to provide a full copy of all personal data, “it is necessary to inform users in a transparent and fair manner about the extent of the information made available”.