Data Protection Commission fines MTCH €11 million following Inquiry into Tinder users’ personal data requests

The Data Protection Commission (DPC) has today announced its final decision following an Inquiry into MTCH Technology Services Limited (“MTCH”), concerning its Tinder service. This own-volition Inquiry was launched by the DPC in January 2020, in its role as the Lead Supervisory Authority for MTCH.

This decision concerns MTCH’s failure to provide Tinder users with a complete copy of their personal data on request, pursuant to Article 15(3) GDPR. In particular, the DPC assessed the operation of a self-service tool on Tinder (known as the Download My Data tool), which enabled users to download their data.

Although this tool was presented to users as a way to obtain a copy of their Tinder data, the DPC found that it failed to provide users with all of their personal data. Certain categories of information were omitted without notice to the user, or provided in summary form only. The DPC also found that the personal data provided through the tool did not meet the requirements of the right of access under the GDPR. 

The decision, made by the Commissioners for Data Protection, Dr Des Hogan, Mr Dale Sunderland and Ms Niamh Sweeney, includes a reprimand and a fine of €11 million.

Deputy Commissioner, Graham Doyle commented:

“The Download My Data tool was presented to Tinder users as a way to request a copy of their personal data. Tens of thousands of users used the Download My Data tool during the period of time assessed by this Inquiry. Such automated access tools can be a useful and efficient way to provide access to personal data and supporting individuals in exercising their GDPR rights. These tools do not need to provide a complete copy of personal data but they must be fair and transparent to individuals regarding the extent of the data provided. 

In addition to the €11 million administrative fine imposed, the DPC has issued an order that MTCH must bring its processing into compliance within three months.

The DPC would also like to thank its peer supervisory authorities for their cooperation and assistance in this case.”

The DPC will publish its full decision in due course.