The exposure of nearly 1.5 million private images from dating apps developed by M.A.D Mobile has prompted widespread concern – but one crucial legal question remains: does this breach involve “special category data” under UK GDPR?
The answer, while not straightforward, is likely to be yes.
What is special category data under UK GDPR?
Under Article 9 of the UK GDPR, special category data refers to information that is particularly sensitive and requires a higher level of protection. This includes data relating to:
- Racial or ethnic origin
- Political opinions
- Religious or philosophical beliefs
- Trade union membership
- Genetic or biometric data
- Health
- A person’s sex life or sexual orientation
In this case, although names and identifying information were not directly attached to the leaked images, the content itself could arguably fall within the definition of special category data.
Many of the exposed images were sexually explicit. Others may reveal sexual orientation, gender identity, or involvement in alternative sexual practices such as BDSM. When combined with the context – namely, that they were hosted on apps specifically catering to LGBTQ+ and kink communities – it becomes clear that this is the unauthorised exposure of intimate, sensitive, and highly personal information.
Legal obligations and potential failings
The UK GDPR is clear: where special category data is processed, the data controller must implement not just general security safeguards, but measures appropriate to the heightened sensitivity of the data. These include stricter technical and organisational controls, explicit user consent for processing, and robust responses to any breach.
M.A.D Mobile appears to have failed on all fronts. The storage was unencrypted, unauthenticated, and left exposed for months. Despite being warned about the issue in January 2025, the company only acted after media intervention – a delay that could have allowed unknown parties to access and store the data.
Who can claim for M.A.D mobile data breach?
This potential mishandling of special category data may give rise to more serious legal consequences, including enforcement by the Information Commissioner’s Office and the amount of compensation awarded to those affected if a compensation claim goes ahead. The fact that the data may qualify as special category data strengthens the seriousness of the breach and, potentially, the value of any resulting claim.
If you used one of the affected platforms, it is worth registering your interest in a group claim.
