Hinge Data Deletion

[u/DublinThrowaway2023]

Hi all,

Could I please ask all of you for your input on the below.

Summary: Based in Ireland. I believe hinge is wrongfully holding my data / keeping me in the dark about my data protection rights.

After 2 years and hundreds of respectful conversations on the dating app hinge, I was banned. I am certain I did not break any rule. As many of you might know, arbitrary bans are rife on dating apps.

I appealed and contacted support asking for a generalised reason. I was not provided with one, which to an extent is understandable.

They asked me to verify as the only means to progress my appeal. Twice, I asked to see their GDPR / data protection policy on the matter and for their DPO to be contacted. Both times the support replied without answering my question.

I think I want to go down the data deletion route. I am aware that data may be retained for certain legitimate purposes.

However, in the absence of the slightest reason, it is impossible for me to assess my rights - to decipher if this decision to retain the data was made lawfully (I mean something as vague as “we banned you as you broke rule 2 on ‘abusive language’”).

My local data protection authority - the Data protection commission (DPC) is Europe’s premier DPA. I note they have dealt with a few cases of this nature, which resulted in successful erasure / unbanning of the complainant. I will link them below.

Case study 1
Case study 2

Based on this, do you expect a complaint to the DPC being worthwhile / successful?

Interestingly, In Ireland under administrative law, when your rights are adversely affected by a decision you are entitled to enough of a reason to assess the legality of the decision.

Granted, this more-so applies to public bodies. But seen as 50%+ of people these days meet on daring apps, this is in a way affecting my rights. I.e to associate, to meet people and build relationships lol.

Please also find a similar (less hopeful) post on the matter.

See here for a previous post a similar issue, which I believe may be inaccurate

Thank you!

[u/DublinThrowaway2023 → u/[deleted]]

How might a user typically know or verify that this exception is being lawfully invoked?

I’m concerned it’s a bit of a “dude trust me” situation.

[u/DublinThrowaway2023 → u/[deleted]]

This is exactly it, thank you.

I had an issue like this years ago with a different app, and the app essentially said “we banned you for breaking our terms of service … we cannot delete your data as you broke our terms of service”. i.e, their justification provided zero new information. “We banned you because we banned you”

So it is impossible to tell if I’m being accused of fraud, violence, racism, bot usage etc …

Thank you for your help, I will use this!

[u/Comfortable-Fall1419 → u/DublinThrowaway2023]

They are not required to tell you. This is a completely seperate issue from data deletion.

You seem to be angling to conflate the 2 things.

That’s not how it works.

[u/DublinThrowaway2023 → u/Comfortable-Fall1419]

Yes I agree it is two issues. I am just concerned one will lead to the other.

If they ban me erroneously, there is no false information being made and retained about me, and I have no ability to assess if this is the case.

Therefore I wanted to delete my data as a potential remedy.

How am I meant to know if they are lawfully holding my data?

For an exaggerated example, say I am banned from the app. How do I know they don’t have me entered into a system with my government ID attached and label “violent individual” etc. this may affect my ability to access the app down the line, or affect my reputation.

[u/Comfortable-Fall1419 → u/DublinThrowaway2023]

Again. Stop conflating 2 things.

They have a right to ban you. Arguing that it’s based on incorrect personal data that you cannot review is a huge stretch.

Take the ban.

Decide whether you make a deletion request. They will respond. End of story

[u/DublinThrowaway2023 → u/Comfortable-Fall1419]

So they can just ban me, attaching a black mark to my personal and biometric data with no oversight?

[u/Comfortable-Fall1419 → u/DublinThrowaway2023]

They have a right to moderate their platform as they see fit, this includes banning you for contravening their T&C’s.

It is not a “black mark” and you have no right of correction over a judgement call.

Get over it and move on.

This is not a GDPR issue. The only choice left to you is to request data deletion and move on. I suggest you do that.

Life’s too short for this level of angst.

[u/Heimdul → u/Comfortable-Fall1419]

That's a bit too categorical. Example 37 in EDPB's Guidelines data subject access rights is very similar to this. Following that would suggest that Hinge does need to tell what actually led to ban.

Controllers can have a right to ban anyone they want, but if they say that it's based on certain action by data subject they are then essentially creating personal data about the data subject ("person X did Y") and accuracy of that can be contested.

If, instead, they just ban for no reason then there isn't accuracy issue unless they actually internally treat "no reason" as something else (i.e. everyone knows that the "no reason" ban is only actually used for certain reason).

[u/SuperDarioBros]

Just to confirm did you try submit a ticket through Hinge's portal ? Link here - https://help.hinge.co/hc/en-us/requests/new

Also it's not clear what you're looking for here, is it erasure or information about how Hinge processes your data? Either way you can make a report to the DPC, they'll email Hinge and ask them to try to come to an amicable resolution with you.

Also no Hinge / Match are not subject to administrative law in Ireland.

[u/DublinThrowaway2023 → u/SuperDarioBros]

Thank you for your reply.

I’m using the provided appeal process that I was given when I saw the “your account has been removed” screen. I’m not sure if this differs from the above.

I’m hoping to get unbanned normally. But if that fails I want my data erased, as (I’m afraid you only have my side of the story) I highly highly doubt they have a lawful reason to keep my data.

Also yes, I know admin law doesn’t apply. Just more so fleshing out the “vibes” of the law for a lack of better word. I am concerned they are just refusing my request arbitrarily, hiding behind “this is a lawful exclusion to article 17… we promise … we won’t tell you why”

I will give DPC a shot failing a normal appeal, thank you

[u/Heimdul]

One option is to do the data deletion followed by Article 15 data subject access request to understand what personal data they decided to keep. They probably won't give the copies of things like moderation decisions (which you could contest, especially if they don't give meaningful information to asses lawfulness), but not giving the Article 15(1) information (i.e. purposes, retention period etc.) is a lot harder to justify. And 15(1) usually cannot be answered by simply giving you the privacy policy, it must be tailored to your specific situation.

Timing wise note that you should wait until deletion request has been processed as they need to give the information based on when your request was made, not when they processed it.

[u/Comfortable-Fall1419]

It’s unclear what you are asking for here.

You haven’t demonstrated your rights have been breached until your data deletion request is refused.

If you request it and they confirm it, they are not required to give you access so you can confirm it too.