Ireland’s Data Protection Commission issued an €11 million fine to Tinder’s parent company Match Group for failing to comply with GDPR personal data rules, rte.ie reported.
The penalty stems from an own-volition inquiry launched in January 2020 by the Irish Examiner reported, focusing on the dating app’s automated self-service feature. The Download My Data tool was presented to users as a straightforward way to obtain copies of their personal records, according to the Irish Independent reported.
“tens of thousands of users used the Download My Data tool during the period of time assessed by the inquiry” Graham Doyle, deputy commissioner of the DPC, told The Journal reported. Regulators found that certain categories of information were omitted without notice, or provided only in summary form.
“What you would get is the number of times you swiped left or right on a particular day, the time you logged in, or the number of matches you made in a day,” Niamh Sweeney told rte.ie reported.
Data omissions failed to meet GDPR access requirements
The Irish Data Protection Commission found that the information supplied to users failed to meet the right of access requirements under Article 15(3) of the GDPR, the Irish Examiner reported. While automated access tools do not need to provide a complete copy of personal data, regulators stressed they must remain fair and transparent.
“But there are other types of data, analytics data that wouldn’t have been included, that could include your gender, your latitude or longitude, the city you were logging in from, and other types of data,” Sweeney told rte.ie reported.
The decision was finalized by the DPC’s three commissioners: Des Hogan, Dale Sunderland, and Niamh Sweeney. Alongside the financial penalty, the regulators issued an order requiring Match Group to bring its data processing into compliance within three months, the Irish Independent reported.
Match Group will appeal the DPC ruling
Match Group has confirmed it will challenge the ruling, which means payment of the penalty must await a decision from the European Court of Justice, according to rte.ie reported. The company had previously allocated at least $9 million for the penalty in recently filed accounts, the Irish Independent reported.
“We have received the DPC’s decision and have decided to appeal,” a Match Group spokesperson told The Journal reported. “Tinder engaged with the DPC throughout this investigation, and we stand behind the privacy protections we’ve built for our users.”
Since 2021, the DPC has issued almost €4.5 billion in fines, though to date only a tiny percentage – €20m – has actually been paid, rte.ie reported. Commissioner Sweeney told rte.ie reported that the agency hopes to secure a ruling from the European court within 12 to 18 months to help clear the backlog of contested payments.
Privacy Compliance Questions
Why did regulators investigate Tinder?
The Data Protection Commission launched an own-volition inquiry in January 2020 to examine how Tinder’s parent company, Match Group, handled user access requests under GDPR rules, according to the Irish Examiner reported.
What data was missing from the download tool?
Users who requested their information received basic metrics like daily swipe counts and login times, but missed analytics data such as precise geographical coordinates, gender details, and login cities, rte.ie reported.
What happens next for the compliance order?
Match Group must bring its data processing into compliance within three months, though the company’s appeal means the €11 million fine will remain on hold pending a decision from the European Court of Justice, according to the Irish Independent reported.
Will the full decision be made public?
The DPC said that it will publish its full decision regarding the Tinder inquiry in due course.
“We have received the DPC’s decision and have decided to appeal,” a Match Group spokesperson told rte.ie reported.