The Privacy Guarantor has imposed a fine of €200,000 on the operator of a popular online dating site for breaching the personal data of approximately 1 million users.
This marks the first instance of the Authority taking action against a dating website. The decision, stemming from an extensive preliminary investigation, that included an on-site inspection, exposed the unlawful handling of user data, including sensitive information regarding sexual preferences and orientations.
To register on the platform, which boasts around 5 million members globally (with over one million having validated email addresses and nearly 10,000 holding active paid subscriptions), users were required to input various details such as their interests, location, date of birth, and email, as well as upload photos to their public profile or private area. However, they were not adequately informed about how their data would be used.
Notably, the platform’s information failed to disclose the multiple additional treatments carried out by the managing company for utilising the provided services. Nor did it outline users’ rights under privacy legislation, including the right to file a complaint with the Guarantor.
The GDPR inspection conducted by the Guarantor also revealed that the site owner lacked a specific privacy policy concerning data retention periods. Instead, they only sporadically deleted inactive accounts and registration requests that did not proceed successfully.
Furthermore, despite being required to do so, the company had not compiled a register of processing activities, appointed a data protection officer, or conducted an impact assessment.
In light of the numerous infractions discovered, the Guarantor, alongside the financial penalty, mandated the implementation of various measures to enhance the security of user data, such as encryption protocols.
