The Irish authority sanctions the publisher of Tinder for providing a data download tool which, although presented as a means to exercise the right of access, only provided an incomplete copy of personal data without informing users.

Facts and context

The Irish Data Protection Commission (DPC) today published a sanction decision against MTCH Technology Services Limited, including the imposition of a fine of €11,000,000, for failures related to requests for access to personal data of users of its Tinder service.

The case originated from an ex officio investigation launched by the DPC in January 2020, in its capacity as lead supervisory authority, concerning the company's inability to provide a complete copy of personal data to users who requested it.

Grounds for the decision

The authority found the following infringement:

• Obligation to provide a copy of personal data (Article 15, paragraph 3, of the GDPR): The DPC's investigation focused on the operation of a self-service tool called "Download my data," presented to users as a means to obtain a copy of their data. The authority found that this tool did not allow downloading the entirety of the personal data processed. Indeed, certain categories of information were omitted without informing the user, while others were only provided in a summarized form. The DPC therefore concluded that the data provided by this tool did not meet the requirements of the right of access.

Decision of the authority

Consequently, the authority imposed a fine of €11,000,000 on MTCH Technology Services Limited. This sanction is accompanied by a reprimand.

Furthermore, the authority ordered the company to bring its processing into compliance within three months.

Lessons learned

This decision reminds that:

• Automated right of access tools, although useful, must be transparent and clearly inform users about the exact scope of the data provided, especially if the copy is not exhaustive.
• Providing a copy of data via a self-service tool while omitting certain categories of information without prior notice, or only communicating them in summarized form, constitutes a breach of the right of access.