Ireland's Data Protection Commission (DPC) has issued its final decision in an investigation into MTCH Technology Services Limited, the company behind Tinder. The inquiry, which began in January 2020, concluded with a reprimand, a fine of €11 million, and an order to achieve compliance within three months.
The headline is the fine, but the real lesson for your team is more specific: a self-service access tool can create liability that a manual process wouldn't, because the tool makes a promise to every user who clicks it.
The Issue with Tinder's Data Tool
The DPC evaluated Tinder's Download My Data tool against Article 15(3) of the GDPR, which requires providing a copy of personal data being processed. The tool was supposed to let users obtain their Tinder data, but it failed to deliver a complete copy. Some data categories were omitted without notice, or provided only in summary form.
The DPC found that tens of thousands of users used the tool during the assessed period. They clarified that automated access tools don't need to provide a complete data copy, but must be fair and transparent about what data is included.
Key Findings
1. Misleading Tool Presentation: The tool was marketed as a way to get a full copy of personal data. The gap between this promise and the actual output led to the penalty. A tool clearly labeled as a partial export would be viewed differently.
2. Silent Omissions: Data categories were excluded without notifying users. Users didn't know they received less than entitled, so they had no reason to request the rest.
3. Summary-Only Data Isn't Enough: When data was only provided in summary form, it didn't meet Article 15(3) requirements. If your export condenses data into summaries, assume there's a compliance gap.
4. Self-Service Tools Are Valid: The Deputy Commissioner described these tools as efficient for supporting GDPR rights. The issue isn't the tool's existence, but its execution.
5. Time-Limited Remedy: The three-month compliance order indicates the DPC expects action, not just payment. The DPC's cooperation with other authorities shows that cross-border decisions are shaped by the broader EU network.
Implications for Your Team
Most DPOs view DSAR handling as a process issue: who handles the request, gathers data, and approves it. This decision shifts focus to the product level. If your team launches an export feature without testing it against Article 15, you might have a compliance gap, with each user session increasing exposure.
Self-service tools face structural challenges. Personal data is often scattered across systems with different owners. An export tool usually queries known systems, but anything added later or less visible may be missed. This is why a tool can be built in good faith and still be incomplete.
A data export tool needs lifecycle governance like any processing activity: documented scope, ownership, change control, and periodic checks. This is Data Protection by Design applied to rights fulfillment.
Action Steps
Priority 1: Test Outputs Thoroughly. Use a test account to request data through your tool. Compare the export to your Article 30 records and data inventory. Identify any missing categories.
Priority 2: Address Gaps. For each missing category, either include it in the export or inform users it's excluded and explain how to request it. The DPC allows some incompleteness if it's fair and transparent, but silent gaps aren't acceptable.
Priority 3: Update User-Facing Text. Review labels, buttons, and help text. If the tool implies a full data copy but doesn't deliver, change the text or the tool. Clearly state what's included and how to request more.
Priority 4: Audit Summary Outputs. Identify data delivered as summaries instead of raw records. Assess if Article 15(3) requires full records, and document your reasoning.
Priority 5: Implement Change Control. Review data mapping whenever a new system or feature is added. Make export scope updates part of the launch checklist, with DPO or privacy team approval.
Priority 6: Create a Manual Request Path. Ensure users can easily escalate to a manual request if they receive a partial export, and that your team can fulfill it within the Article 12(3) timeframe. A clear escalation route supports the transparency the DPC expects.
Priority 7: Document Decisions. If you decide a category is outside Article 15's scope, keep the analysis on file. Accountability under Article 5(2) means you should be ready to show your reasoning to a regulator.
