A dating profile holds more than a name and a photo. Messages, preferences, location history and account details can build up over months or years, and you have legal rights over that information. This article explains the rights described by the Information Commissioner’s Office (ICO), the UK’s data protection regulator, so you can use them when you leave an app, change platform or simply want to know what an app holds about you.
Your right to a copy of your data
The right of access, often called a subject access request (SAR), lets you ask an organisation for the personal information it holds about you. The ICO’s public guidance says you should include a subject line or header that says “subject access request” together with the date, your name, contact information and any relevant account numbers. Be specific about what information you want, add any details or dates that help the organisation find it and say how you would like to receive it. It says the easiest ways to make a request include online and email, though you can also make one by post, over the phone or face to face.
The ICO says organisations usually have one month to respond, and that they can sometimes refuse to provide all or some of the information you ask for. If someone else makes a request on your behalf, the organisation will ask for proof, such as written permission or a power of attorney document.
Your right to have data deleted
The ICO’s guidance on the right to have your data deleted says you can ask an organisation to erase your data in several situations, including where:
- the organisation no longer needs it for the reason it was collected;
- you withdrew consent you previously gave;
- your interests outweigh the organisation’s after you object;
- you objected to direct marketing;
- the data was collected or used unlawfully; or
- the data was collected from you as a child for online services.
You can make the request verbally or in writing, though the ICO recommends following up in writing so you have a record. No specific wording is required. The organisation has one calendar month to respond, and can extend that by up to two further months if necessary, but must tell you within the first month and explain why. In most circumstances no fee applies, and charges are allowed only for manifestly unfounded or excessive requests.
When an app can refuse
Deletion is not absolute. The ICO lists reasons an organisation may refuse, including freedom of expression and information, legal retention obligations, public interest tasks or official authority, establishing or defending legal claims, and certain research or archiving purposes. Requests deemed manifestly unfounded or excessive may also be refused. Whether any of these applies to a particular dating app is for the app to explain, so ask for its reasons in writing if you receive only a partial response.
Moving your data elsewhere
The right to data portability lets you obtain your personal data in a way that is accessible and machine-readable and, where technically feasible, ask for it to be transferred to another organisation. The ICO says it applies to data held electronically that you have provided to the organisation, and this includes monitored activity data such as search history and location data. It applies where the organisation relies on your consent or uses your data as part of a contract with you. Data should be supplied in a commonly used, machine-readable format such as a CSV file, and the organisation has one month to respond, extendable by up to two months if it explains why.
What if the app does not respond?
The ICO’s deletion guidance says to complain directly to the organisation first. If you are still dissatisfied, you can make a complaint to the ICO, or pursue enforcement through the courts. The ICO’s separate guidance on identity theft notes that the ICO can deal with information rights but cannot deal with cases of identity theft itself, so if you believe your data has been used to impersonate you, other bodies such as Cifas and the police are the right route.
A sensible order of steps when leaving an app
- Decide whether you want a copy first. A subject access request or portability request before deletion means you keep a record of what was held.
- Send the request in writing, with the subject line “subject access request” or a clear request for erasure, and keep a dated copy.
- Diary the one-month deadline.
- Delete the account once you are content with what you have received, so that you keep a record of what was held.
- If the response is incomplete, complain to the app first and then the ICO.
The bottom line
Under the data protection rights the ICO describes, you can ask a dating app for a copy of your data, ask for it to be deleted in the situations the ICO lists, and in some cases have it provided in a portable format. Organisations usually have one month to respond, with possible extensions of up to two months, and can refuse in limited circumstances. If an app does not comply, complain to it first and then to the ICO. Requests in writing, with dates kept, make the process easier.