Ireland’s Data Protection Commission (DPC) has fined MTCH Technology Services Limited – the owner of Tinder – €11 million for failing to providing users with complete copies of their personal data.
The DPC’s decision follows an inquiry launched in January 2020.
It examined the dating app’s “Download My Data” tool, which allowed users to request and download information held about them.
The regulator found that some categories of personal data were omitted without users knowing, whilst other information was supplied only in summary form.
The regulator concluded that the data provided through the tool did not meet the requirements of users’ right of access under Article 15(3) of the EU’s GDPR (General Data Protection Regulation) law.
The DPC today decided to issue MTCH with a reprimand alongside the €11 million administrative fine. It also ordered the company to bring its processing into compliance within three months.
MTCH’s owner, Match Group, said they would appeal the decision.
Deputy Commissioner at the DPC, Graham Doyle, said tens of thousands of users used the tool during the period examined.
“Such automated access tools can be a useful and efficient way to provide access to personal data,” he said, but added that users must be treated “fairly and transparently” about what information a tool provides.
Doyle said the tool “must be fair and transparent to individuals regarding the extent of the data provided”.
The inquiry was handled by the DPC as lead supervisory authority for MTCH, since the company’s European headquarters are based in Dublin.
MTCH is part of Match Group, which owns Tinder.
Responding to the Data Protection Commission’s decision, a Match Group spokesperson said:
“We have received the DPC’s decision and have decided to appeal. Tinder engaged with the DPC throughout this investigation, and we stand behind the privacy protections we’ve built for our users.”