Ireland fines Tinder's owner €11 million for handing users incomplete copies of their data
Ireland's Data Protection Commission (DPC) on November 13 fined MTCH Technology Services Limited, the Irish Match Group company responsible for Tinder in Europe, €11 million. According to the regulator's decision, the Download My Data tool that Tinder users relied on to get a copy of their data did not hand over everything: some categories were left out without notice, and others were given only in summary form. Besides the fine, the company received a reprimand and three months to bring its processing into compliance.
In short
- The DPC opened the inquiry on its own initiative in January 2020 and reached a decision almost seven years later.
- Tens of thousands of people used the tool during the period examined.
- Match Group plans to appeal the fine.
What Tinder got wrong
Article 15 of the GDPR gives everyone the right to a copy of their personal data. Tinder presented Download My Data as the way to get that copy, but the DPC found that people received an incomplete set without being told. The regulator will publish the full decision later, so it is not yet known exactly which categories of data were missing.
The DPC does not require such buttons to hand over absolutely everything. "Such automated access tools can be a useful and efficient way to provide access to personal data," said Deputy Commissioner Graham Doyle. "These tools do not need to provide a complete copy of personal data but they must be fair and transparent to individuals regarding the extent of the data provided." The breach was the silence about what was left out.
What Match Group says
Match Group had known since the summer that the regulator was preparing a fine of €8 million to €11 million. In its latest filing with the US Securities and Exchange Commission, the company said the disputed policies were largely designed to protect user safety and privacy, and it set aside a $12.6 million provision for the fine, Global Dating Insights reports. The company believes it has strong grounds for an appeal.
It is not the DPC's largest decision this autumn: in September it fined Google €403 million over location tracking.
How to get all of your data
- Start with the download button in the service's settings, but do not assume the result is complete unless the service says so.
- If something is missing, such as messages, photos or location data, send the company a written subject access request under Article 15 of the GDPR and ask for a full copy.
- Under the GDPR the company must reply within one month. In complex cases it can extend this by two more months, but it has to tell you.
- If there is no reply or it is incomplete, file a complaint with the data protection authority in your EU country.
