An Coimisiun um
Chosaint Sonrai
Data Protection
Commission
DPC Inquiry Ref: -
DPC Complaint Ref:
Date: 7 March 2024
Complainant: Mr. H.R.
Data Controller: Apple Distribution International Limited
RE: H.R. v Apple Distribution International Limited
This document is a Decision of the Data Protection Commission of Ireland ("DPC") in
relation to DPC complaint reference C-21-10-964, hereinafter referred to as the
("Complaint"), submitted directly to the DPC by Mr. H.R. ("Complainant"), against
Apple Distribution International ("Apple").
This Decision is made pursuant to the powers conferred on the DPC by section
113(2)(a) of the Data Protection Act 2018 ("the Act") and Article 60 of the General
Data Protection Regulation ("GDPR").
Communication of Draft Decision to "supervisory authorities concerned"
In accordance with Article 60(3) of the GDPR, the DPC was obliged to communicate
the relevant information and submit a Draft Decision, in relation to a complaint
regarding cross border processing, to the supervisory authorities concerned for their
opinion and to take due account of their views.
In accordance with its obligation, the DPC transmitted a Draft Decision in relation to
the matter to the "supervisory authorities concerned". As Apple offers goods and
services across the EU, and therefore the processing is likely to substantially affect
data subjects in every EU member state, the DPC in its role as lead supervisory
authority identified that each supervisory authority is a supervisory authority concerned
as defined in Article 4(22) of the GDPR. On this basis, the Draft Decision of the DPC
in relation to this complaint was transmitted to each supervisory authority in the EU
and EEA for their opinion. No relevant and reasoned objections were received from
any supervisory authorities concerned. Comments were received from four
supervisory authorities, further details of which are set out below.
1
An Coimisi(m um
Chosaint Sonrai
Data Protection
Commission
Complaint Handling by the DPC - Timeline and Summary
1. The Complainant lodged his complaint directly with the DPC on 25 October 2021.
The Complainant stated that he believed Apple's retention of his email address
following an erasure request was not compliant with the GDPR. The Complainant
contended that Apple failed to give effect to his rights under the GDPR, in
particular that it failed to properly handle his erasure request and give proper
effect to his erasure request in respect of the processing and retention of his
personal data. The Complainant provided the DPC with a copy of his email of 31
August 2021 to Apple, in which he asserted that Apple breached his right to
erasure and right to be forgotten, as per Article 17 of the GDPR in relation to an
erasure request he made to Apple on 03 March 2019. The Complainant stated
that Apple had confirmed to him that it would delete his Apple ID and all data
associated with his Apple ID. The Complainant stated that when he attempted to
create a new Apple account in order to manage his daughter's new phone, using
his email address, which had previously been associated with his own account
with Apple, he received notification from Apple that the email address could not
be used as it was already in use/linked to another Apple account. The
Complainant stated that after a number of unsuccessful attempts, he discussed
his concern with an agent acting on behalf of Apple. He stated that the agent
informed him that his personal data had been deleted but that he could not use
his email address again for another Apple account. The Complainant stated that
if Apple has a copy of his email address, then his email address had not been
deleted. The Complainant stated that he was ultimately informed by Apple that it
doesn't necessarily mean that his account is in Apple's system and that it just
means that it is no longer usable on its system. He stated that his understanding,
based on information provided to him by Apple, is that his account still exists but
that it is inactive, and therefore it was not deleted by Apple even though he had
made an erasure req uest in March 2019. The Complainant stated that it appears
Apple deactivated his account rather than deleting it, even though Apple had
informed him around the time of his erasure request that it had deleted all his
personal data.
2 The Complainant provided the DPC with a copy of Apple's response dated 02
September 2021. In its response, Apple stated that its records confirmed that the
Complainant's email address is associated with a previously deleted account and
that, as a policy, Apple reserves the right not to allow the reuse of email addresses
as a security measure to prevent identity theft. Apple further stated that users are
presented with the deletion terms and conditions when deleting an account on
Apple's website. Apple stated that it was not retaining the Complainant's email
address but that it does hold a one way hash of the email
2
An Coimisiun um
Chosaint Sonrai
Data Protection
Commission
address, which is stored with the deletion event to ensure it has a record of having
completed his request, to allow it lo comply with its legal obligations and for
security purposes. Apple also stated that it also uses this hashed form in deciding
whether to decline the re-use of an email address and that it does not attempt to
extract the email address from the hashed value retained.
3. The Complainant responded to Apple by email on 01 October 2021 stating that his
right to be forgotten has been breached because Apple retains this information
forever. The Complainant stated that he understands Apple's requirement to audit
deletion requests and he pointed out that there are methods to perform this activity
without retaining an encrypted form of his email address.
4. Apple responded to the Complainant by email on 12 October 2021. Apple stated
that it noted that the Complainant stated that as Apple retains the hashing
algorithm, it has the ability to decrypt an encrypted format of his email address.
Apple referred the Complainant to its previous correspondence which explained
why it retains a one way hash of his email address. Apple stated that its previous
correspondence described the reasons for which it must retain this limited
information to ensure it has a record of having completed his request and to allow
it to comply with its legal obligations and for security purposes. Apple stated that
without retaining this value, it would not be able to prevent the recycling of
namesp,a ces by users, or to protect its users against fraud and security breaches
by third parties seeking to use their email addresses to impersonate the users, or
to gain control over a name which has previously been associated with an Apple
ID account thereby creating a potential vulnerability in its systems. Apple stated
that the retention of this hashed value is specifically highlighted to users seeking
to delete their Apple ID and that it does not attempt to extract the user's email
address. from the retained hashed value. Apple stated that it noted that the
Complainant stated that it keeps a publicly available encrypted version of his
email address to prove that it has deleted his account to comply with its legal
obligations. Apple stated that it would like to note that it does not retain a publicly
available version of the Complainant's email address and that his email address
is retained as a hashed value.
5. The DPC wrote to the Complainant by email on 28 January 2022 requesting
further information.
6. The Complainant submitted a record of his initial deletion request and
correspondence with Apple, by email on 17 February 2022. The Complainant
stated that Apple was retaining his email address and potentially additional
personal data with his email address and that Apple did not inform him that it
3
An Coimisi(m um
Chosaint Sonrai
Data Protection
Commission
would be retaining his email address. The Complainant stated that he had
accounts deleted by other providers and his email address was deleted entirely
from their systems. The Complainant submitted that Apple only needed to retain
an encrypted log of the deletion request and confirmation that it had been deleted.
7. The DPC wrote to the Complainant on 04 March 2022 acknowledging his
complaint.
a The DPC notified Apple of receipt of the complaint on 15 March 2022 and
provided it with a copy of the complaint and the accompanying correspondence.
9. Apple responded to the DPC by letter dated 30 March 2022. Apple stated that it
takes the privacy and security of its customers' personal data very seriously, and
it designs its processes with that in mind. Apple stated that it has an online Data
Privacy page which allows users to understand, access and control the personal
information they store with Apple, at https://privacy.apple.com. Apple stated that
the information it retains following the deletion of an Apple ID is extremely limited
and that it retains a one way hash of the user's Apple ID email address which is
stored with the deletion event, along with the user's Directory Services Identifier
("DSID") and any verified emails associated with the account. Apple stated that it
retains this information for specific security and compliance purposes. Apple
stated that it does not attempt to extract the user's email addresses from the one
way hash of the data retained or seek to identify the DSI D from those email
addresses. Apple stated that access to the relevant data is partitioned to limit the
risk of access to all data by a nefarious third party, and access is limited to specific
Production Support and iCloud team members who have a strict need.
10. Regarding where in the Apple ID account deletion process/Terms and Conditions
the user is specifically informed that Apple will retain a record of the user's email
address and the purpose and basis for this retention, Apple submitted that 'tu]sers
are presented with the Deletion Terms which explicitly address the point raised
... [ .. .] ... before they proceed to delete their account". Apple submitted that the
Deletion Terms state ''if you choose to create a new Account subsequently, you
will need to use an email address that is not associated with the Account you have
requested that we delete because we have to retain a record of the deleted
Account. If you would like to modify your Account before proceeding with the
deletion process, please log in to appleid.apple.com. However, you will be unable
to remove the primary email address for the Account" and that the Deletion Terms
also state that '1w]here we delete an Account, Apple makes its best efforts to
delete all personal data associated with your Account. We do retain data to
comply with other legal obligations such as where we need to retain transaction
4
An Coimisiun um
Chosaint Sonrai
Data Protection
Commission
information which may include your data for financial reporting p urposes. We may
also be required to retain information to comply w;fh a court settlement or other
equivalent mandated process". Apple submitted a copy of the Deletion Terms and
Conditions which it stated is presented to users who seek to delete their Apple ID
on the Data and Privacy page. Apple stated that in light of that, it believes that it
is entirely transparent with its users about the very reasonable basis on which it
considers that it is obligated to retain this extremely limited data.
11. The DPC queried the precise personal data of the Complainant that was retained
by Apple following his Article 17 erasure request, and the retention period/s and
corresponding rationale or basis for same. Apple stated that in this case, following
the deletion of the Complainant's Apple ID, the data it retained is a one way
hashed form of his email address. Apple stated that this limited data is retained
by it . Apple stated that this data is retained because deleting
it after a specific period would re-open the security and compliance risks it has
previously described and create a vulnerability in its systems. Apple stated that if
this information was deleted after a specific period, then this would essentially
permit the recycling of the namespace and open up the use of the namespace by
third parties for fraudulent purposes. It stated that it would also mean that the
evidence of deletion of a customer's Apple ID would be removed and it would
therefore have no record of its compliance with the request in that respect. -
financial transaction information in relation to the account, which it says is retained
to meet its financial reporting obligations in relation to financial transactions, which
require it to retain such records for ten years.
12 Apple provided the DPC with a copy of its assessment regarding its legitimate
interests in respect of the retention of the Complainant's personal data. Apple
stated that it had already completed the deletion of the Complainant's account.
Apple stated that it wished to highlight again that it does not have some
underhand or malicious intent retaining a hash of the email addresses. Apple
stated that in fact it is not using them for marketing, advertising or profiling
purposes. It stated that it is not used at all unless a user seeks to create a new
Apple ID using the same email address and only then, following a match, will it
block that process for all the reasons described. Apple stated it is the only means
it has available to it to prove that it has in fact undertaken the deletion requested
by the user.
13. The DPC reverted to Apple on 22 April 2022 providing an update on the status of
the complaint and asked Apple to address a number of queries, including the
following: to confirm whether Apple informs data subjects at the time when their
5
An Coimisiun um
Chosaint Sonrai
Data Protection
Commission
personal data (email address) is obtained from them that a hash value of their
email address/Apple ID will be generated and retained indefinitely in the event of
account deletion, to confirm the hashing algorithm used by Apple to generate the
hash value of the email address/Apple ID in the event of account deletions and if
Apple would give further consideration to what additional step it could take to
enhance a user's understanding of the personal data that will be retained by Apple
following account deletion.
14. Apple responded by letter dated 06 May 2022. It referred to the Deletion Terms
and Conditions referenced in its letter dated 30 March 2022 and the information
set out in relation to what is presented to users in relation to the retention of very
limited personal data post the deletion of their Apple ID. Apple stated that it does
not, as of 06 May 2022, specifically inform users at the time their Apple ID is
generated that a hash value of their Apple ID is retained following the deletion of
their Apple ID. Apple stated that whilst it believes that the information it currently
provides to users, as described in its letter of 30 March 2022, provides them with
clarity on the continued processing of limited personal data following the deletion
of an Apple ID, it stated that it was updating its user interface and information
documents presented to users when they create an Apple ID, to make It clear to
users that in the event of an account deletion, Apple retains personal data to
comply with legal obligations such as where it needs to retain transaction
information which may include personal data for financial reporting purposes and
for account security purposes. Apple stated that it may be required to retain
information to comply with a court settlement or other equivalent mandated
process, and that Apple retains personal data for so long as necessary to fulfil the
purposes for which it was collected.
15. Apple confirmed that the hash value of relevant email addresses are obtained
with the specific algorithm.
16. In an attempt to amicably resolve the complaint Apple stated that, while it believes
that the wording provided in the Deletion Terms and Conditions meets this aim, it
is in the process of reviewing the user interface presented to customers when
they seek to delete their Apple ID, to make it clearer to users that the primary
~mail address or any verified email addresses associated with their account
cannot be used to create a new Apple ID account. Apple stated that it was also
updating the Deletion Terms and Conditions to clarify that where it deleted an
account, it retains personal data to comply with legal obligations such as where it
needs to retain transaction information, which may include personal data, for
financial reporting purposes and for account security purposes. Apple stated that
ii will also make ii clear that it may be required to retain information to comply with
a court settlement or other equivalent mandated processes and that in addition it
6
An Coimisiun um
Chosaint Sonraf
Data Protection
Commission
will explain that Apple retains personal data for so long as necessary to fulfil the
purposes for which it was collected.
17. The DPC wrote to the Complainant by letter dated 13 June 2022 wherein the DPC
outlined Apple's response.
18. The Complainant responded to the DPC by email of 14 June 2022. He stated that
he remained dissatisfied with Apple's response and actions, and he set out his
reasons for same, including querying Apple's reasoning for the retention of a
hashed version of his personal data and he stated that he believes that Apple
have done nothing apart from deactivating his account and that it has not deleted
his personal data.
19. The DPC wrote to Apple by letter dated 12 July 2022 wherein the DPC set out the
response received from the Complainant. The DPC also asked Apple could
provide a further response to address the substance of the concerns and points
raised by the Complainant.
3J. Apple responded by letter dated 25 July 2022. Apple stated that the
Complainant's deletion request in relation to his relevant Apple ID account had
been fully processed and carried out as set out in the email he had received from
Apple on 03 March 2019. Apple stated that given that it believed it had already
completed the deletion of the Complainant's account, it did not believe that there
were any further steps that it could take to amicably resolve the complaint without
negatively impacting on its ability to comply with its own obligations but stated that
it was willing to consider any proposals from the DPC in that regard. Apple stated
that the hashed personal data is not used at all unless a user seeks to create a
new Apple ID using the same email address and only then following a match wi ll
it block the process for all the reasons it described and that it is the only means
available to it to prove that it has in fact undertaken the deletion requested by a
user. Apple stated that there is no data model as speculated by the Complainant
and that it has no such purpose for such model.
21. The DPC wrote to Apple by letter dated 05 August 2022 advising that it had not
been possible to reach an amicable resolution of the complaint and that
accordingly, the DPC was required to comply with section 113(2) of the Act and
make a Draft Decision in respect of the complaint.
Conduct of lngujry
Z2. Acting in its capacity as lead supervisory authority, the DPC commenced an
7
An Coimisiun um
Chosaint Sonraf
Data Protect ion
Commission
Inquiry in relation to this matter by issuing a Notice of Commencement of Inquiry
to Apple on 02 November 2022.
23. The DPC notified Apple that the Inquiry would seek to examine and assess
whether or not Apple had complied with its obligations under the GDPR and the
Act, in particular under Articles 6,12,13, and 17 of the GDPR in respect of the
relevant processing operations which are the subject matter of the complaint. The
DPC set out a number of queries for Apple's response.
24. The DPC notified the Complainant on 02 November 2022 that an Inquiry had
commenced in relation to his complaint. The Complainant acknowledged receipt
of tho DPC' s notification on same date.
25. The Complainant, by email dated 13 November 2022, submitted:-
"I have spent some time thinking about this and feel vindicated in my
assessment that Apple have improperly managed my data. I look
forward to the inquiry and the opportunity to highlight some issues in
the way that Apple are handling data.
To summarise my concerns:
• Apple stated that they would delete my account, however they
deactivated my account.
• Apple constantly stress that the account login is hashed and this
is sufficient based on my request, I do not agree, hashing is not
sufficient to protect privacy.
• Apple have stated that no deletion has taken place as per my
request. I believe that the reason they deactivate accounts is
due to the large and complete data model that persists users
information. A user will be associated with usage profiling,
device history, application history etc. as an organisation that
may be over collecting information, to delete this data or even
de couple it would potentially place a large overhead on the
organisation. I have no evidence to back this up but I think it is a
logical explanation for their hesitancy to delete my account in its
entirety. I will note that the site catchoftheday did delete my
account when I requested and I was able to recreate my account
some years later when I returned to the site and had no issues
using the same username."
8
An Coimisiun um
Chosaint Sonrai
Data Protection
Commission
· 33. Apple responded to the queries raised by the DPC in its Notice of Commencement
on 23 November 2022.
Zl,. Regard ing Article 17 of the GDPR and the Complainant's erasure request, Apple
submitted that an account deletion request in relation to the Complainant's Apple
ID was logged on its "Data and Privacy portal' on 03 March 2019. Apple provided
a copy of the log of that request, including the timestamp. •
28. With regard to when Apple first responded to the erasure request, Apple stated
that a confirmation of the handling of the deletion request for an Apple ID is sent
as soon as a data subject successfully places a request. Apple stated that the
confirmation was sent to the Complainant's relevant email address, which is the
same email used for his Apple ID, on same day as his request on 03 March 2019
at 10:58:43 GMT. Apple provided a copy of the template email of confirmation
sent to all data subjects who successfully place a request.
~- In response to the DPC's request to Apple to clarify and confirm whether the
Complainant's erasure request was in fact given effect to, completed and the date
on which all the data was deleted, it submitted that "[a]s explained in our letter of
25 July 2022, 'we can confirm that [the Complainant's] Apple ID accountdeletion
request in relation to the Apple ID [Complainant's relevant email ad~ress] has
been fully processed and carried out as set out in the email he had received on 3
March 2019". Apple submitted that deletion requests on an Apple ID are carried
out following a fraud check
submitted that, in relation to the Complainant's Apple ID account, the deletion was
initiated across its systems on 21 March 2019. Apple stated that the deletion of
the Apple ID does not mean that all data related to the account had been erased,
Apple submitted that it indicates clearly to data subjects that some data may be
retained. Apple submitted that, following the deletion of an Apple ID, it retains a
one-way hash of the user's Apple ID email address, the logs of the erasure
request and the deletion event, and, it stated, as applicable, categories of data
retained to comply with legal obligations such as financial transaction records
related to purchases from Apple retail stores, purchases and downloads from
Apple Services and subscriptions to Apple Services. Apple stated that the above
reflects the retention policy put in place by it, and the categories of data that may
be retained as applicable, to comply with its obligations under both data protection
law and under other applicable laws, such as tax or reporting obligations.
3). Apple submitted that, with regard to the Complainant's account, with relevant
Apple ID email address, it retains "a one way hashed version of his Apple ID
9
An Coimisiun um
Chosaint Sonrai
Data Protection
Commission
email address and a DSID which is also retained in one way hashed form" and
it stated it that "we also hold financial transaction information in relation to this
account, retained to meet our financial reporting obligations in relation to
financial transactions".
31.
The PC requested that Apple provide it with the corresponding retention
period for each of the different categories of personal data retained by Apple
following completion of the Complainant's erasure request. Apple submitted
I that the hash values of the relevant email addresses are stored for as long as
l
necessary. Apple submitted that the DSID is stored for as long as necessary.
Apple stated that this is because:-
"If this information was deleted after a specific period, then this would
essentially permit the recycling of the namespace and the [sic] open up
the use of the namespace by third parties for fraudulent purposes. It
would also mean that evidence of deletion of a customer's Apple ID
would be removed and we would therefore have no record of our
compliance with the request in this respect. Imposing a hard end date
for the retention of this data would defeat the very purposes for which
the data is retained."
32. Apple submitted that the data associated with purchases is retained for ten
years, as disclosed in its privacy information document ''Apple ID & Privacy"
which is provided to users when creating an Apple ID and available to them
thereafter. Apple stated that the relevant section "Data Retention" provides that
"where you make a purchase such as a subscription, we retain personal
information associated with your purchase for the periods specified by
applicable laws relating to financial reporting, which vary by region. For most
customers, that requires at least a 10-vear retention period."
33. Regarding the legal basis for retaining each category of personal data following
completion of the Complainant's erasure request and why the retention is both
necessary and proportionate, Apple submitted that it retains data following an
erasure request on the basis of its legitimate interests ·and to comply with its
legal obligations, under Articles 6(1 )(c) and (f) of the GDPR. Apple provided a
copy of its legitimate interests' assessment.
3t Apple submitted:-
"This one way hashed value is retained to allow us to comply with our
legal obligations under Article 17(3)(b) of the GDPR, and in accordance
with the overriding legitimate interests which we have in continued
10
An Coimisiun um
Chosaint Sonraf
Data Pro tection
Commission
processing of this information under Article 17(1)(c) of the GDPR. We
require this one way hashed value to demonstrate compliance with the
user's request to delete their information under Article 17(1) of the
GDPR, and to allow us to show compliance with our own security
obligations under Article 32 of the GDPR, in accordance with the
principle of accountability under Recital 74 of the GDPR. If we did not
retain this value, then we would have no evidence that we had complied
with the Apple ID account deletion request if, for example, your Office
was to seek it. In addition without retaining this value, we would not be
able to prevent the recycling of namespaces by users, or to protect our
users against fraud and security breaches by third parties seeking to
use their email address to impersonate the user, or to gain control over
a name which has previously been associated with an Apple ID
account, thereby creating a potential vulnerability in our systems".
Apple stated:-
Our Apple ID ecosystem
does not allow, or support, the same email address being associated
with multiple Apple IDs. ff one email address was associated with
multiple Apple fDs, then that model would fundamentally break, leading
to system issues and mass customer confusion. For example, a sharing
invitation sent to an email address on multiple Apple ID accounts would
potentially lead to more than one person having access to the material
shared, or customer confusion about which account should or should
not have access to that material. The purpose of this processing is
consistent with the purpose for which the data was originally collected
in accordance with Article 17(1)(a) of the GDPR, which is to facilitate
user account management and verification (amongst other things). This
is described in our explanatory file guide on Apple ID account
information, which is available to users at https:/lprivacy.apple.com/file
guides".
33. Apple stated that "[i]t is important to note that the retention of this hashed value
is an expected behaviour which is specifically highlighted to users seeking to
delete their Apple ID... [... ] .... The information retained by Apple in such cases
is extremely limited and we do not attempt to extract the user's email address
from the hashed value retained". Apple stated that with regard to the retention
of information for tax or financial reporting obligations, it is subject to a variety
of retention obligations across regions.
11
An CoimisiCm um
Chosaint Sonrai
Data Protection
Commission
'Sf. Apple submitted that when a user creates an Apple ID it provides information
to notify the user of the processing and purposes of personal data retention.
Apple provided a screenshot of its webpage which set out that a user's Apple
ID information is used to allow users to sign in securely and access their data,
that it records certain data for security, support and reporting purposes and
that, if the user agrees, Apple may also use their Apple ID information to send
marketing emails and communications, including based on their use of Apple
services. The screenshot Apple provided included a link "[s]ee how your data
is managed''. Apple stated that "users are thereby able to 'see how their data
is managed' by accessing our privacy document 'Apple ID and Privacy'..."
Apple stated that "its section 'Data Retention' in particular provides that:
Tw]here you make a purchase such as a subscription, we retain personal
information associated with your purchase for the periods specified by
applicable laws relating to financial reporting, which vary by region. For most
customers, that requires at least a 10-year retention period... Apple stated that
in addition, and as referenced at the end of its privacy document 'Apple ID &
Privacy', its users in general are notified of the purposes of processing their
personal data, and of the retention thereof, by way of the Apple Privacy Policy
and of which users are notified in the course of creating an Apple ID in
particular.
Apple provided extracts of what it perceived to be the relevant parts of this
Privacy Policy, and stated that it added underlines for the exact information
responding to this matter. Apple stated its current Privacy Policy, a copy of
which it submitted to this Inquiry, provides, in its section 'Apple's Use of
Personal Data' that personal data may be processed and retained for the
following purposes:-
" '• Security and Fraud Prevention. To protect individuals, employees,
and Apple and for loss prevention and to prevent fraud, including to
protect individuals, employees, and Apple for the benefit of all our
users. and prescreening or scanning uploaded content for potentially
illegal content, including child sexual exploitation material."'
'"• Comply with Law. To comply with applicable law -
for example, to
satisfy tax or reporting obligations, or to comply with a lawful
governmental request."'
"'Apple retains personal data only for so long as necessary to
fulfil/ the purposes for which it was collected, including as
described in this Privacy Policy or in our service specific privacy
notices, or as required by law. We will retain your personal data for
12
An Coimisiun um
Chosaint Sonrai
Data Protection
Commission
the period necessary to fulfil/ the purposes outlined in this Privacy
Policy and our service-specific privacy summaries. When assessing
retention periods, we first carefully examine whether it is necessary to
retain the personal data collected and, if retention is required, work to
retain the personal data for the shortest possible period permissible
under Jaw."'
33. Apple stated that in the section on 'Your Privacy Rights at Apple', its Privacy
Policy provides:-
"There may be situations where we cannot grant your request - for
example, if you ask us to delete vour transaction data and Apple is
legally obligated to keep a record of that transaction to comply with law.
We may also decline to grant a request where doing so would
undermine our legitimate use of data for anti-fraud and security
purposes."
40 Apple stated that the relevant parts of the Privacy Policy in place in 2019, at
the time of the relevant deletion request, a copy of which it provided to this
Inquiry, provided that:-
"We a/so use personal information to help us create, develop, operate,
deliver and improve our products, services, content and advertising,
and for loss prevention and anti-fraud purposes. We mav also use vour
personal information for account and network security purposes.
including in order to protect our services for the benefit of all our users."
'We will retain your personal information for the period necessary to
fulfil/ the purposes outlined in this Privacy Policy and our service
specific privacy summaries. When assessing these periods we
carefully examine our need to collect personal information at all and if
we establish a relevant need we only retain it for the shortest possible
period to realize the purpose of collection unless a longer retention
period is required by law."
41. Apple stated that in addition, at the time of completing an erasure request, its
users are required to indicate that they have read and agree to the Apple ID
Deletion Terms and Conditions (effective from 30 August 2022), a copy of
which it provided to this Inquiry, and which give additional details on retention
of data:-
"If you choose to create a new Account later, you will need to use an
13
An Coimisi(m um
Chosaint Sonraf
Data Protection
Commission
email address that is not associated with the Account you have
requested we delete, because we need to retain a record of the deleted
Account to comply with legal obligations and for account security
purposes. as described below. [. . .] Note that you will not be able to
remove the primary email address for the Account or the phone number
if you used it to create the account. "
"We do retain personal data to comply with legal obligations such as
where we need to retain transaction information, which may include
your data for financial reporting purposes and for account security
purposes. We may a/so be required to retain information to comply with
a court settlement or other equivalent mandated processes. "
42. Apple stated that the "relevant Deletion Terms and Conditions" in place when
the erasure request was made in 2019 already provided the following:-
"If you choose to create a new Account subsequently, you will need to
use an email address that is not associated with the Account you've
requested we delete as we have to retain a record of the deleted
Account. [. . .] you will be unable to remove the primary email address
for the Account."
"We do retain data to comply with other legal obligations such as where
we need to retain transaction information which may include your data
for financial reporting purposes. We may also be required to retain
information to comply with a court settlement or other equivalent
mandated process."
43. Apple also provided a screenshot of "the step of the account deletion process
at which acceptance of these Deletion Terms and Conditions is required'.
44. In response to the DPC's query regarding where, and in what form all the
personal data is retained/stored, Apple submitted that its Privacy Policy
provides for this in the section 'Transfer of Personal Data Between Countries'.
45. Apple submitted that the access controls put in place, in relation to the retained
personal data, are described in its Privacy Policy. Apple stated that it has
implemented organisational and technical measures in accordance with the
highest standards of privacy protection. Apple stated that its Privacy
Governance approach is available at: https://www.apple.com/legal/privacy/en
ww/governance/ and it provided a copy of same. Apple stated that as set out
in its letter of 30 March 2022 "we employ multiple layers of security for the
14
An Coimisiun um
Chosaint Sonrai
Data Protection
r Commission
retained personal data. Access to this data is a/so partitioned to limit the risk of
access to all data by a nefarious third party, and access is limited to specific
Production Support and iC/oud team members who have a strict need''. Apple
stated that the access is subject to additional internal guidance and policies,
including on Information Security and It provided a copy of same to the DPC.
Apple stated that its Logical Access and Authentication policy covers thetools
and processes that allow for electronic access to its resources. Apple stated
that this policy defines the requirements for governance, management, and
implementation of logical access, and outlines its personnel responsibilities
around safeguarding resources at Apple. Apple stated that the policy details a
number of access controls.
Apple stated that the hash value of relevant email addresses are obtained with
the specific algorithm.
tfl. In response to the DPC's query as to whether the personal data retained by
Apple is ever used for any purpose other than what is outlined in its Privacy
Policy, Apple submitted that in addition to the purposes laid out in its Privacy
Policy it also specifies purposes in the 'Apple ID & Privacy' document and in
its Deletion Terms that it may be required to retain information for other legal
purposes, such as to •·comply with a court settlement or other equivalent
mandated processes". Apple stated that if it deleted an Apple ID's email
address without retaining its corresponding hash value, Apple would not be in
a position to confirm that an account deletion request has been fully processed
in accordance with Article 17 of the GDPR. Apple stated that it wished to
highlight that Apple does not have some underhand or malicious intent for
retaining a hash of these email addresses. Apple stated that it is not using them
for marketing, advertising or profiling purposes. Apple stated that they are not
used at all unless a user seeks to create a new Apple ID using the same email
address and, only then, following a match, will it block out that process for all
the reasons it has described. Apple stated that this is the only means it has
available to it to prove that it has undertaken the deletion requested by a user.
Apple stated that there is no '"data modef' as speculated by the Complainant
and it would have no purpose for any such model.
48. Apple submitted that it retains a '"one way hash"' of the relevant email
addresses and DSID and that it does" not attempt to extract the user's email
addresses from the one way hash of the data retained or seek to identify the
DSID from those email addresses". Apple stated that following completion of
an erasure request, the personal data used by Apple to verify the identity of a
user with regard to his/her control of an Apple ID, is no longer retained by
Apple. Apple stated that it is therefore not possible for it to provide a copy of
15
An Coimisiun um
Chosaint Sonrai
Data Protection
Commission
financial transaction records or other retained information, as it does not have
a means to verify the account holder's identity without the account details that
were deleted as part of the account deletion process. Apple stated that it
considers that the hashed values in question do not enable Apple to identify
[the Complainant] in accordance with Article 12(6) of the GDPR.
49. In response to the DPC's questions in relation to transparency and modalities,
and information and access to personal data, in particular information to be
provided where personal data are collected f rom the data subject, Apple
submitted that it places significant time and effort into ensuring that it provides
transparency to its users on the way in which it collects and processes their
personal data. Apple stated that it has put in place industry leading
transparency for its users. Apple stated that new users are presented with a
privacy screen as part of their device activation with only one purpose:
education. Apple stated that this screen does not seek to collect a consent or
for a user to otherwise agree to personal data collection but instead was
designed and introduced in 2018 with the sole purpose of educating users on
Apple's Data & Privacy icon, which, it says, is shown to users when they first
launch or sign in to a service or feature that collects or uses personal data,
including for the creation of an Apple ID. Apple stated that key information on
what personal data is collected, and why, is presented to the user immediately
below the icon. Apple stated that this information is accompanied by a link to
commonly branded information - "'See How Your Data is Managed"- which
takes users to a detailed description of the personal data practices for that
service or feature. Apple stated that this informational document is also
available at any time in the various Operating Systems and online at its Support
site. Apple stated that it noted that the relevant Apple ID was created in 2009
and therefore, the GDPR and in particular its Article 13, were not applicable at
that time. Apple has provided a copy of its applicable Privacy Policy (last
updated 29 June 2007). Apple stated "as you might expect from a document
that predates GDPR by a decade, it does not contain all the information later
required by Article 13'. Apple stated that it is not able to provide other
information in the interface at the time.
Sl Apple stated that, in addition to the information already set out above,
information with respect in particular to Articles 13(1 )(c) and (d) of the GDPR
is included in its Privacy Policy (marked as Updated 27 October, 2021) , a copy
of which it submitted to this Inquiry, in its section ''Apple's Use of Personal
Data" which states:
''Apple uses personal data to power our services, to process your
transactions, to communicate with you, for security and fraud
16
An Coimisiun um
Chosaint Sonrai
Data Protection
Commission
prevention, and to comply with law. We may also use personal
data for other purposes with your consent. Apple uses your
personal data only when we have a valid legal basis to do so.
Depending on the circumstance, Apple may rely on your consent or the
fact that the processing is necessary to fulf;Jf a contract with you, protect
your vital interests or those of other persons. or to comply with law. We
may also process your personal data where we believe it is in our or
others' legitimate interests, taking into consideration your interests,
rights, and expectations. If you have questions about the legal basis,
you can contact the Data Protection Officer at
apple. comllegallprivacy!contact."
51. Apple stated that its Privacy Policy provides a list of purposes of processing,
detailed therein, notably: to power its services, process transactions, and
communicate with users, for security and fraud prevention, for personalisation
of services or communications, and to comply with law.
52. Apple stated that the relevant parts of the Privacy Policy in place in 2019, at
the time of the relevant deletion request, also included a list of purposes with
details, and notably the following information on the legal basis:-
"How we use your personal information We may process your
personal information: for the purposes described in this PrivacyPolicy,
with your consent, for compliance with a legal obligation to which Apple
is subiect or when we have assessed it is necessary for the purposes
of the legitimate interests pursued by Apple or a third party to whom it
may be necessary to disclose information."
53. Apple stated that upon receiving the Complainant's query of 31 August 2021,
Apple Privacy responded on 1 September 2021 mentioning its legitimate
interest to "'prevent identity theff'' and stating its purposes "'to comply with [its]
legal obligations'" and its "'security purposes"'.
54. In response to the DPC's query regarding when and how Apple took
appropriate measures to notify the Complainant that a hashed value of his
email would be generated and retained following his erasure request and
following account deletion, Apple submitted that, in response to the written
query sent by the Complainant to its Privacy team on 31 August 2021, it
informed the Complainant on 01 September 2021 of the following:-
"When deleting an account on our website privacy.apple.corn, users
are presented with the Deletion Terms and Conditions, which include
17
An Coimisiun um
Chosaint Sonraf
Data Protection
Commission
the following information:-
'If you choose to create a new Account subsequently, you will need to
use an ema/1 address that is not associated with the account you have
requested that we delete because we have to retain a record of the
deleted account. If you would like to modify your Account before
proceeding with the deletion process, please log in to
appleid.apple.com. However, you will be unable to remove the primary
email address for the Account'.
'I would like to explain thatwe are not retaining your email address but
hold a one way hash of the email address, which is stored with the
deletion event to ensure we have a record of having completed your
request, to allow us to comply with our legal obligations and for security
purposes. We also use this hashed form in deciding whether to decline
the re-use of an email address. We do not attempt to extract the email
address from the hashed value retained.'
Apple submitted that on 12 October 2020 it further informed the Complainant
of the following:-
"We note that you state that as Apple retains the hashing algorithm, we
have the ability to decrypt an encrypted format of your email address.
We would kindly refer to our previous email which describes why we
retain a one way hash of your email address. The retention of this
hashed value is an expected behaviour which is specifically highlighted
to users seeking to delete their Apple ID, as described in our previous
email.
We do not attempt to extract the user's email address from the hashed
value retained. We note that you also state that we keep a publicly
available encrypted version of your email address to prove that we have
deleted your account to comply with our legal obligations. We would
like to note that we do not retain a publicly available version of your
email address, which is retained as described above."
ffi Apple provided this Inquiry with case notes in relation to this correspondence.
'51. Apple stated that it does not specifically inform users that a hash value of their
Apple ID will be retained following the deletion of their Apple ID. Apple stated
that, while its intention is to be entirely transparent with its users about the data
Apple collects and processes, It does not consider that providing this level of
detail would be required or appropriate, considering the highly technical nature
18
An Coimisiun um
Chosaint Sonrai
Data Protection
Commission
of this aspect. Apple stated that it is very clear that it is retaining a record of the
email address as it makes it clear to users that email addresses cannot be re
used. Apple stated that the only way to give effect to this requirement is to have
a means to prevent re-use. Apple stated that it considers that the above fulfils
its obligations under the GDPR with respect to the disclosure of the fact of
retaining a one way hash value of the email address and DSID.
ffi In response to the DPC's query regarding whether the Complainant was
informed that certain personal data may be retained indefinitely at the time he
created his account, Apple noted that it does not consider that it retains
personal data indefinitely. Apple stated that the account in question was
created on 22 September 2009 via iTunes and would have required the user
to accept the then-applicable Terms of Service, dated 09 July 2008. Apple
submitted a copy of these terms to the DPC. Apple submitted that these Terms
of Service stated:-
"6. Apple's Privacy Policy. Except as otherwise expressly provided for
in this Agreement, the Service is subject to Apple's Privacy Policy at
http://www.apple.com/legal/privacvl, which is expressly made a part of
this Agreement. If you have not already read Apple's Privacy Policy,
you should do so now."
00. Apple stated that the applicable Privacy Policy at the time
has since been updated several times, including but not
limited to updates in May 2018 and in October 2021 .
ffl Apple submitted that as the account iin question was created on 22 September
2009 it was not able to confirm what was presented to a user creating an
account and providing their email address thirteen years ago.
61. The DPC issued a letter to Apple, dated 09 December 2022, stating that the
DPC was not at the time seeking that Apple provide an exhaustive schedule of
the exact categories of data being retained insofar as each financial system of
record was concerned. The DPC advised Apple that, notwithstanding this, if
Apple takes the view that additional information is relevant in the context of the
subject matter of the Complainant's complaint then it was to provide same. The
DPC further stated that it reserved the right to raise such further or other
queries as are deemed necessary, including as may arise out of Apple's
responses.
62. Apple responded to the DPC by letter dated 23 December 2022. Apple stated
that it takes note that the DPC is not at this time seeking that it provide an
exhaustive schedule of the exact categories of data being retained insofar as
19
An Coimisiun um
Chosaint Sonraf
Data Protection
Commission
each financial system of record is concerned for the Apple ID in question. Apple
thanked the DPC for the opportunity to provide further relevant details on its
data retention practices described in its previous letter to the DPC dated 23
November 2022. Apple stated that it wished to highlight relevant excerpts of its
Apple ID Deletion Terms and Conditions outlining the reasons for the retention
of data following the completion of a deletion request for an Apple ID account.
63. In relation to the retention of a record of the deleted account, Apple stated that
pursuant to the Deletion Terms:-
"we need to retain a record of the deleted Account. To modify your
Account before proceeding with the deletion process, sign in to
appleid.apple.com. Note that you will not be abfe to remove the primary
email address for the Account."
64. Apple stated that for this it retains one-way hashes of the user's Apple ID email
address, and the DSID that was associated with the account, as well as
timestamps and logs of the erasure request and the deletion event.
ffi. In relation to the retention of data to comply with legal obligations, Apple stated
that, pursuant to the Deletion Terms:-
"If a purchase is made online on the App Store, iTunes, Book Store,
Online Store, Apple retains the time and date of the purchase; the name
and address of purchaser, as well as his/her email address and DSID
if purchased in a signed-in state; device information; operating system
information; the IP address of the purchase; payment information, but
not the actual credit/debit card details themselves; details of the item
purchased which would incfude serial number if a physical product;
storefront information; details associated with an offer if purchased as
part of an offer. This information is retained for 10 years from the
transaction event, with the exception of the IP address retained for 18
months."
ffi. In relation to the retention of data for account security purposes, Apple stated
that, pursuant to the Deletion Terms:-
"We do retain data to comply with legal obligations [...] and for account
security purposes."
fI/. Apple stated that it retains a subset of the above
post transaction. Apple stated that this is without prejudice to the retention of a
record of the deleted account. including the retention of hash values to prevent
20
An Coimisiun um
Chosaint Sonrai
Data Protection
Commission
reuse of Apple JD email addresses, carried out for the account security
purposes previously described to the DPC.
In relation to the retention of Information to comply with court settlements or
other mandated process, Apple stated that pursuant to the Deletion Terrns:-
"We may also be required to retain information to comply with a court
settlement or other equivalent mandated process. Apple retains
personal data for so long as necessary to fulfil the purposes for which
it was collected."
00. Apple stated that it has been required to retain information in order to make
refunds to customers or as part of product recalls.
70. In relation to the retention of a record of the deleted account, Apple stated that
pursuant to the Deletion Terms:-
"Deletion does not cancel any repairs or Apple Store I apple.corn orders
in progress. Any appointments you've scheduled at the Appia Store will
be [cancelled}. If you 're enrolled in the /Phone upgrade program, you
must continue making payments for your device. If you're enrolled in
AppleCare+, you won't lose your ability to receive service on your
device as provided for under that program."
71. Apple stated that it retains records associated with the serial number of all
repairs associated with a device post deletion and that it removes all personal
data as part of the deletion.
72 By correspondence dated 13 July 2023, the DPC issued additional queries to
Apple. Apple responded, by correspondence dated 20 July 2023. Apple
submitted that it understood this was a complaint-based Inquiry and as such
that the scope is limited to the factual scenario on the date of the complaint. II
stated that several of the questions are general in nature and that as would be
standard its practices have evolved over time since the initial request.
73. Apple submitted that if it had retained the logs of the data subject's erasure
request event without retaining the hash, it would not be able to have evidence
that it complied with his specific erasure request. It stated that it would also not
have been able to respond to Query 1 in the Commencement of Notice letter
dated 02 November 2022 (i.e. queries concerning date of receipt of the
erasure, date Apple responded to the erasure request, etc.). It referred to its
previous correspondence of 25 July 2022 and the information set out therein
In respect of the purposes for which it considers the retention of these hashed
21
An Coimisiun um
Chosaint Sonrai
Data Protection
Commission
values necessary.
74. Apple submitted that should it receive a query from a customer or from the
DPC in relation to a specific Apple ID, without retaining the hashed version of
the email address it would technically have no means to confirm that it deleted
a specific Apple ID. It stated that its customers generally do not know what the
DSID is, but they do know what their email address is and, which one they use
or used for their Apple ID.
75. Apple submitted that email addresses
It stated that people may change
their names and addresses over time, and names are also not sufficient to
uniquely identify a person, not only because Apple does not verify the names
that customers indicate on their accounts. It stated that it does not see how an
alternative method would serve the objective of demonstrating compliance with
Article 17 or how it would serve its user's privacy and interests better than
retaining hashed values of the unique identifiers its systems are built to rely on.
76. Apple submitted that it cannot comment on the practices of other providers nor
would it have any knowledge into how they decided they can evidence deletion
requests on their systems. It stated that it is possible that a user's email
address plays a less central role for other providers perhaps given the
multiplicity of other information they collect. It stated that other providers may
also validate identity in a more invasive manner at account sign up stage and/
or beyond. It stated that it is for each controller to assess their own obligations
under the GDPR. It stated that it undertook a careful assessment and
concluded that certain datasets were necessary to retain for compliance and
legal reasons, detailed in its letters of 30 March 2022 and 25 July 2022. It stated
that the right to erasure is not an absolute one and there are grounds set out
in GDPR to validly retain data. It stated that these were carefully considered
as reflected in its Legitimate Interests Assessment.
71. Apple submitted that deleting the hashed value of email address after a specific
period would re-open the security and compliance risks previously outlined to
the DPC and create a vulnerability in its systems. Apple stated that if this
information was deleted after a specific period, then this would essentially
permit the recycling of the namespace and open up the use of the namespace
by third parties for fraudulent purposes.
78. Apple submitted as follows:-
22
An Coimisiun um
Chosaint Sonraf
Data Protection
Commission
"The prohibition on re-using email addresses associated with a deleted
Apple ID is indeed a security measure. The hashed value of the
relevant email address and DSID are rendered using the [specific
algorithm]. If a hashed value of a deleted email address was not
retained, we believe that a nefarious third party could obtain access to
that email address perhaps through recycling or compromise and could
create a new account using that email address and purchase Apple
services whilst Impersonating the genuine user. Apple would thereby
be at risk of facilitating identity fraud rather than preventing it, as is the
intent of its current policies."
79. Apple submitted that it cannot comment on the decisions and practices of other
controllers. It stated that it would however note that an email domain provider's
decision to recycle email addresses In 2013 was widely criticised by
information security practitioners and users. Apple stated that it did not know if
recycling of these accounts is still possible or not. Apple stated that it is its
understanding that old email addresses of another email domain provider were
able to be recycled but now cannot be. Apple stated that as commentators at
the time pointed out, allowing recycling of email addresses opens the original
holder up to Identity fraud. Apple stated that the new holder of the recycled
email address could use the '"forgot password" function on any number of third
party sites to reset third party passwords and thereby gain access to the
original holder's accounts. Apple stated that the new holder of the recycled
email address may also receive emails intended for the original holder
containing sensitive information. It stated that the sender of the email would
not be aware that the original holder no longer had access to that email
address.
Apple submitted that in the context of preventing the reuse of email addresses,
it is unclear how retaining a name and address would have an impact or would
fulfil the objectives it has outlined above, orwouid better serve its user's privacy
and interests better than retaining hashed values of the unique identifiers its
systems are built to rely on. It stated that it continuously reviews its practices
and that it remains open to any alternative solutions.
81. Asked by the DPC to specify when exactly/at what point is/was the hashed
value of the DSID created, Apple submitted that Its logs show it received a
deletion request for the relevant Apple ID to its Data and Privacy page on 03
March 2019. It stated that it had not been able to confirm whether or not it has
the information to respond to the information sought in the short turnaround
time for responding. Apple later submitted that the DSID is not hashed.
82. Asked by the DPC to specify when exactly/at what point is/was the hashed
23
An Coimisi(m um
Chosaint Sonrai
Data Protection
Commission
value of the email address created, Apple submitted that its logs show it
received a deletion request to its Data and Privacy page on 03 March 2019. It
stated that
- for it to be completed in accordance with Article 12 of the GDPR. It
stated that for the data that is retained, it says in accordance with the data
minimisation principle, the data is hashed. It stated that
for the email address to fully
undergo the hashing procedure across its systems. It stated that for the
Complainant this would have been on or around 21 April 2019.
81 The DPC issued a Supplemental Notice of Inquiry to Apple on 25 July 2023.
The DPC advised Apple that, in addition to the issues previously notified to
Apple in the Commencement Notice, that Article 5 of the GDPR also forms part
of this inquiry under, and in accordance with, Section 110(1) of the Data
Protection Act, 2018. The DPC sought further information from Apple in that
regard.
84. By correspondence dated 09 August 2023, Apple responded to the
Supplement Notice of Inquiry. It stated that it views the principle of storage
limitation as fundamental and treats its obligations in this respect extremely
seriously. It stated that when assessing retention periods, it first carefully
examines whether it is necessary to collect the persona l data at all, and then if
it does collect personal data it works to retain the personal data for the shortest
possible period permissible, including taking account of applicable law. It
stated that where it thinks it is justified, in very limited instances such as in this
case, it implements longer periods of retention that are subject to periodic
reviews ensuring that its storage of personal data is limited to what is strictly
necessary.
Apple submitted that the formulation of the DPC's query seems to imply that
the DPC has formed a view that Apple would be subject to an obligation to
erase the relevant hashed values after a "specific retention period'. Apple
submitted that it believes that with regard to the specific circumstances and the
security rationale in which the hashing of the relevant values is carried out, the
ongoing retention of such hashes complies with Apple's obligations under the
GDPR.
ffi. Apple submitted that the GDPR principle of storage limitation does not create
an absolute obligation to erase data after a specific time limit. It set out that
Recital 39 of the GDPR provides that controllers are required "'in particular, [to]
ensurfe] that the period for which the personal data are stored is limited to a
strict minimum"'. It contended that however this does not necessarily require
that a definite period of retention is set after which data must be erased or
24
An Coimisiun um
Chosaint Sonrai
Data Protection
Commission
deleted in all cases. It submitted that instead the cited provision continues:
"Personal data should be processed only if the purpose of the processing could
not reasonably be fulfilled by other means. In order to ensure that the personal
data are not kept longer than necessary, time limits should be established by
the controller for erasure or for a periodic review." Apple contended that it is
therefore abundantly clear from the above recital that the EU legislator has
envisioned that there may be circumstances in which certain purposes cannot
be reasonably fulfilled by means other than processing personal data, including
by retaining data in storage. It is also expressly specified that time limits may
be established for a p,eriodic review to assess the necessity of retention for the
relevant purposes as a legally admissible alternative to data erasure. It stated
that in other words, data may be retained for a period as long as strictly
necessary, and the necessity of retention may be assessed subject to a
periodic review. It stated that it is for a data controller to consider the
appropriate retention for each set and justify its decision. It stated that it carries
out periodic reviews of its retention practices including those subject to this
complaint. It stated that it was not its intention to give the DPC the impression
that it retains the data indefinitely without further consideration.
'iJ'/. Apple submitted that should the EU legislator have envisioned an obligation to
erase data after a specific time limit in the absolute and regardless of the
circumstances, it would have stated so clearly in the GDPR. Apple stated that
it believes that it is instructive that the ePrivacy Directive, for example, does
contain express obligations to erase or anonymise specific categories of data.
It stated that that is not the case in the GDPR. It stated that it believes that this
was not an oversight of the EU legislator, nor an inconsistency. It stated that
the nuance and flexibility allowed in the GDPR was meant exactly for the kind
of specific circumstances that Apple faces in the context of the retention that is
the subject of this Inquiry. Apple submitted that, in that regard , it would point to
the "Quick Guide to the Principles of Data Protection"1 published by the DPC.
It stated that in this guidance, the DPC repeatedly makes clear that the deletion
or anonymization of personal data after a specific time limit are generally, but
not absolutely, required - i.e. it depends on the circumstances. Apple stated
that in the section "Storage Limitation" the DPC indicates:
"Controllers should therefore, in general, delete personal data as soon
as it ceases to be necessary for the purposes for which it was originally
collected."
1 httos://www.dataorotection.ie/sites/default/files/uploads/2019-
11/GuidanceonthePrinciolesofDataProtectionOctl9.pdf.
25
An Coimisi(m um
Chosaint Sonrar
Data Protection
Commission
"Depending on the circumstances. it may also be appropriate for
controllers to anonymise data once it is no longer necessary that the
individual be identified or identifiable".
Apple contended that these formulations by the DPC implies that there may be
specific circumstances in which erasure or anonymization are not necessarily
required. It stated that this view is supported by other supervisoryauthorities2.
00. Apple submitted that the provisions of Article 5( 1)(e) do not create an absolute
obligation of erasure on controllers. It stated that more specifically, the principle
of storage limitation as set forth therein provides that "personal data shall be
[. ..] kept in a form which permits identification of data subjects for no longer
than is necessary for the purposes for which the personal data are processed'.
It stated that there are therefore two cumulative elements which must be
assessed to ensure compliance with the principle of storage limitation; first,
whether the personal data in question is "kept in a form which permits
identification of data subjects" and, second, whether the retention of personal
data in this form is justified by the necessity of the purposes of processing.
00. Apple submitted that in the instance of this Inquiry the retention of the hashed
values that is subject of the Complainant's complaint is fully in line with the
principle of storage limitation.
91. It stated that first, the retention of the hashed values only does not permit
identification of the data subject unless combined with additional data. It stated
that in the subject matter raised by the Complainant, it would again note that
the hashing operations are carried out to minimise the amount of data retained,
in a way that means that Apple does not retain the relevant account data, such
as the Apple ID email address itself. In this respect it referred to its previous
submissions regarding its "ability to identify the Complainant' to which it
responded:
"following the completion of an erasure request, the personal data used
Apple to verify the identity of a user with regard to his/her control of an
Apple ID, is no longer retained by Apple. It is therefore not possible for
Apple to provide a copy of financial transaction records or other
retained information, as we do not have a means to verify the account
2 The information Commissioner's Office guidance, written when they were an EDPB member, available at
htt ps://ico.org.uk/for-orga nisations/u k-gd pr-guida nee-and-resources/ data-protect ion-principles/a-guide-to- the-data-
protection-princip les / the-principles/storage-limitation/ states: "You should consider whether you need to keep a
record of a relationship with the individual once that relationship ends. You may not need to delete all personal data
when the relationship ends. You may need to keep some information so that you can confirm that the relationship
existed - and that it has ended - as well as some of its details."
26
An Coimisiun um
Chosaint Sonra,
Data Protection
~ Commission
holder's identity without the account details that were deleted as part of
the account deletion process.
As a result, we consider that the hashed values in question do not
enable Apple to identify the Complainant in accordance with Article
12(6) of the GDPR."
92. Apple stated that, second, in any event, the retention of the hashed values is
justified notably by the necessity of purposes pursued by Apple, and
compliance with legal obligations. It referred in that respect to its letter of 23
December 2022 to this Inquiry which it stated covers in detail the purposes of
its retention of data, including personal data if any.
Apple submitted that it continuously reviews its policies and practices to ensure
that it meets its purposes and its legal obligations, and to ensure that its
retention of data aligns with the needs of balancing both privacy rights and
security or legal requirements. It stated that in particular this issue is subject to
periodic assessments. It stated that it would like to make clear and to elaborate
on and clarify its submission of 30 March 2022 that it is not its intent to retain
the data in question forever in any event without submitting this retention to a
periodic assessment.
94. Apple submitted that the reason why there is no definite period currently set
and after which an automatic erasure has already been implemented is due to
the account security purposes which it covered for instance in its previous
letters of 25 July 2022 and of 20 July 2023. It stated that in that context,
-
retention of the relevant hashed values is strictly necessary to enforce
its policy to prevent the reuse of an email address which has or had already
been used as part of the method that it uses to identify another account.
gj_ Apple stated that it would submit that its policy constitutes an important
measure of security. It stated that due to the fact that email addresses are part
of the unique way that Apple IDs are identified for authentication, email and
documentation sharing purposes, as well as many other purposes, any change
of this policy would have a great impact on its Apple ID ecosystem and thus on
its users. It stated that it must therefore act with great caution. It referred to its
letter of 20 July 2023 providing justifiable security concerns. It stated that only
if these concerns are properly addressed through adequate means it may be
in a position to adapt its policy on the recycling of Apple IDs for dele1ed
accounts.
Apple submitted that in the case of the Complainant it believes that the inability,
caused by its current policy, to create a new account by reusing the same email
27
An Coimisiun um
Chosaint Sonrai
Data Protection
Commission
address as a previously deleted account is, at most, a mere inconvenience. It
stated that the Complainant fully retains the ability to create a new account,
with any other email address. It stated that its policy therefore does not impinge
on the Complainant's fundamental rights in any way. It stated that it does not
keep the data for any commercial interest (or any benefit for Apple in particular
other than its own customer's security) nor can it use it for any other purpose.
W. Apple submitted that on balance it believes that its policy provides an
acceptable position between security concerns and usability of its products and
services. It stated that for the reasons above it considers that the retention of
hashed values to enforce its policies and comply with its legal obligations is
strictly necessary and therefore in line with its business requirements.
Notification of the Preliminary Draft Decision to the Data Controller
The DPC provided Apple with a copy of the Preliminary Draft Decision, by
correspondence dated 28 August 2023. Apple responded, by correspondence
dated 25 September 2023, as follows:- "We have reviewed the Preliminary
Draft Decision and we should comment at the outset that overall we are content
with [the DPC's] conclusions. It is reassuring to read that our assessment that
we can rely on our legitimate interests to retain of a small amount of data for
the specific purposes of demonstrating compliance and for security reasons is
understood. We agree with [the DPC's] further conclusions that we met our
GDPR obligations in response to [the Complainant's] erasure request. We
however have some comments on [the DPC's] preliminary conclusion that
Apple did not meet is transparency requirements. "
00. Apple elaborated on and clarified previous submissions it made to the DPC, in
particular it submitted that it would like to clarify that only the email address is
hashed and that the DSID is not hashed. It stated that when the email address
is hashed, all associations between the DSID and email address are removed .
It stated that whilst this is a change to its previous communications, it felt that
this does not change the overall point that Apple reta ins only the minimum
amount of data necessary and that the DSID is an internal identifier from which,
once other data is disassociated, a user cannot be identified.
1Ul Apple submitted that for completeness it was providing its Privacy Policy (dated
29 June, 2007) that was in place at the time of the Complainant's account
creation. Apple had previously submitted that it could not locate this Privacy
Policy in place at the time of account creation. It submitted that "[a]s you might
expect from a document that predates GDPR by a decade, it does not contain
all the information later required by Article 13".
101. Apple submitted "[w]e are somewhat troubled that [the DPC] is reaching the
28
An Coimisiun um
Chosaint Sonrai
Data Protection
Commission
view in [paragraph 143 of the Preliminary Draft Decision, paragraph 157 of the
Draft Decision, now paragraph 165 below] that we failed to meet our
transparency requirements under Article 13 of the GDPR. [The DPC] appear
to have reached this view as Apple did not specifically indicate 'hashed value
of email address' as a specific data category that would be retained post Apple
ID account delete in the Apple ID Deletion Terms and Conditions ('Deletion
Terms'). It would appear to be an extreme interpretation of Article 13 that each
and every data element would need to be highlighted in the Deletion Terms.
We would certainly consider that including 'a record of the deleted account'
would more than convey that the record would need to be such to allow for the
account to be capable of being identified in a specific set of circumstances".
102. Apple submitted that notwithstanding this view, the DPC refers to the extracts
of Apple's Privacy Policy in which it inform users that certain data sets may be
retained for security/fraud purposes, or for financial reporting obligations at
paragraph 50 but that it does not form part of the DPC's conclusion into
whether Apple met its transparency obligations.
103. Apple submitted that the DPC, in its conclusions, also does not refer to the
Apple ID & Privacy notice, which is provided to users when creating an Apple
ID and available to them at any time on their devices under Settings/Personal
Information and on the web
https://www.apple.com/legal/privacy/data/en/apple-id/. It stated that this page
contains specific details on its processing of Apple ID's including the retention
period for any retained data. It stated that following the concerns raised by the
DPC in relation to the transparency of retained data, it added paragraphs under
the heading of Retention on 01 February 2023 as follows: "Where you make a
purchase such as a subscription, we retain personal data associated with your
purchase for the periods specified by applicable laws relating to financial
reporting, which vary by region. For most customers, that requires at least a
10-year retention period.. . If you delete your Apple ID account, we retain a
record of the deleted account to comply with legal obligations, including as
described above, and for so long as necessary for the legitimate interests of
account security. If you choose to create a new account later, you will need to
use an email address that is not associated with the account you have
requested we delete ... We may a/so be required to retain information to comply
with a court settlement or other equivalent mandated process." It stated that
this document does not seem to have been given sufficient weight in the DPC's
conclusion that transparency information it provides is not sufficient.
1(}1.. Regarding paragraph 145 of the Preliminary Draft Decision [paragraph 159 of
the Draft Decision, now paragraph 167 below], Apple submitted that the DPC
refers in paragraph 143 [now paragraph 165] and subsequent paragraphs to
29
An Coimisiun um
Chosaint Sonraf
Data Protection
Commission
the Deletion Terms In place at the lime of the Complainant's complaint. It stated
that it appreciates that this is a complaint based Inquiry and this the DPC's
scope is limited to considering the factual scenario at the time. It stated that
however due to the concerns raised by the DPC it has since updated the
Deletion Terms as follows: "If you choose to create a new Account later, you'll
need to use an email address that is not associated with the Account you 've
requested we delete, because we need to retain a record of the deleted
Account to comply with legal obligations and for account security purposes, as
described below'.
100. Apple further submitted that users are provided with a summary of what
deleting their account will mean in practice prior to being shown the Deletion
Terms. It stated that selecting the 'Delete your account' option on its Data &
Privacy page, which is the location users are directed to make an erasure
request, leads users to text, including "The email address that you use with
your Apple ID account, [relevant email address] will no longer be available for
use with any new or existing Apple ID. To ensure that ii can't be used again, a
record of this email address will remain on file with Apple". It submitted that
users were and are provided with sufficient information across the Apple
Privacy Policy, Apple ID & Privacy notice, Data & Privacy page and the
Deletion Terms to encompass the retention of a hash of their email address. It
stated that users are informed in the relevant privacy notice that it retains some
data, then immediately afterwards that they cannot reuse their email address.
It stated that it remains its position that ii is not necessary to include specific
detail that the reta ined data Is actually a hashed email as this is too technical
for most users and the key information has already been provided. It stated
that Article 13 of the GDPR does not require controllers to list specific data
types.
100. Apple submitted that it respectfully disagreed as a point of law that Article 13
requires Apple to provide specific notice about the one data point at the time a
data subject takes an action that may affect it, In addition to the transparency
information already provided.
107. Apple submitted however that it is always seeking opportunities for
improvements and are open to additional just-in-time notices about processing
in the interests of transparency. It stated that with that in mind, that a more
appropriate location for any additionally required specific transparency
information would be the succinct summary shown to users who select 'Delete
your account' on its Data & Privacy page, rather than the Deletion Terms. It
stated that it remained open to the view of the DPC.
30
An Coimisiun um
Chosaint Sonra,
Data Protection
Commission
Notification of the Preliminary Draft Decision to the Complainant
100. The DPC provided the Complainant with a copy of the Preliminary Draft
Decision, by correspondence dated 12 September 2023. The Complainant, by
email dated 25 September 2023 submitted:
"Their entire argument seems to revolve around the encryption clause and at
no point do they reference the more secure technology of tokenisation.
Tokenisation not only protects users data but prevents it from being accessed
internally within an organisation.
I do find it curious that they have not defined a unique user identification
system that they maintain ownership of, the assumption that a user will always
have access to a single email address to authenticate is a flawed concept.
I feel that Apple are avoiding responsibilWes that could be easily be addressed
with the inclusion of additional technologies and ammendments to their
'deletion' process to clarify that they will retain the email address in
perpetuity. I feel that to label the request as a 'permanent deactivation of an
account' would be a more accurate definition of the action they are
performing."
100. The DPC has carefully considered the submissions of the Complainant and
Apple in making this Decision.
Communication of Draft Decision to Concerned Supervisory Authorities
110. A draft of this decision was transmitted to the Concerned Supervisory
Authorities (CSAs) across the EU and EEA pursuant to Article 60.3 of the
GDPR.
111. No relevant and reasoned objections were received from any of the CSAs.
112 Comments were received from the following CSAs: Netherlands SA,
Hungarian SA, Italian SA and BayLDA. The DPC has engaged - in
relation to them.
113. Apple's
position throughout our correspondence with the complainant and your Office
makes it clear that there are two main reasons why retention is necessary:
1) To demonstrate that we complied with the deletion request.
31
An Coimisiun um
Chosaint Sonrai
Data Protection
Commission
2) To enforce our policy of not allowing the ''recycling " of Apple ID email
addresses, which contributes to ensuring a high level of security (e.g. against
risks of identity theft).
32
An Coimisi(m um
Chosaint Sonrai
Data Protection
Commission
-
33
An Coimisi(m um
Chosaint Sonraf
Data Protection
Commission
...[ ... ] ... Notwithstanding the above, we have started a new review of our current
process on [sic] to ascertain whether there are cases presently in which the
retention of the relevant hash would [no] longer be strictly necessary for the
objectives set out above.
With regard to the security and technical risks, we have convened with our
security and engineering teams to review the period for deletion of the hashed
email addresses at some fixed period of time.
34
An Coimisiun um
Chosaint Sonraf
_ Data Protection
Commission
An Coimisiun um
Chosaint Sonrai
Data Protection
Commission
-
-
3
https://curia.europa.eu(juris/document/document.jsf?text=&docid=275125&pagelndex=O&doclang=EN&mod
e=lst&dir=&occ=first&part=1&cid=12610227
4
https://curia.europa.eu/juris/document/document.jsf?text=&docid=243244&pagelndex=O&doclang=EN&mod
e=req&dir=&occ=first&part=1&cid=12611276
36
An Coimisiun um
Chosaint Sonrai
Data Protection
Commission
37
An Coimisi(m um
Chosaint Sonrar
- Data Protection
Commission
-
114.
115.
-
38
An Coimisiun um
Chosaint Sonrai
Data Protection
Commission
116.
117. The DPC has carefully considered the comments regarding the Draft Decision
that were submitted by the four concerned supervisory authorities
in making this Decision.
Applicable Law
118. For the purposes of its examination and assessment of this complaint, the DPC
has considered the following Articles of the GDPR:
• Article 5
• Article 6
• Article 12
• Article 13
• Article 17
Analysis and Findings of Inquiry
Issue A - Whether Apple had a lawful basis for retaining a hashed value of
the Complainant's email address on foot of processjng an erasure request
pursuant to Article 17 of the GDPR.
39
An Coimisiun um
Chosaint Sonraf
Data Protection
Commission
119. The Complainant complained about Apple's handling of his erasure request
asserting that Apple had failed to properly comply with it. He stated that Apple
confirmed to him that It would delete his Apple ID and all his personal data
associated with his Apple ID. He contended that Apple retained his Apple
account and his personal data, in particular his email address, linked to his
account, in circumstances where, he says, Apple informed him that it had
deleted his account and all his personal data. The Complainant informed the
DPC that he became aware that Apple had retained his personal data when he
tried to create a new account using his email address. He received notification
from Apple that the email address could not be used for a new Apple account
as it was already in use/linked to another Apple account.
121 The Complainant asserted that Apple was retaining his personal data, namely
his email address which was associated with his Apple ID, in breach of his data
protection rights, in particular Article 17 of the GDPR. The Complainant
contended that Apple failed to give effect to his rights under the GDPR, in
particular that it failed to property handle his erasure request and give proper
effect to his erasure request in respect of lhe processing and retention of his
personal data.
121. Apple informed the DPC that it received the Complainant's account deletion
request in relation to the relevant Apple ID on 03 March 2019. Apple informed
the DPC that the request was fully processed and carried out as it had set out
to the Complainant by email of 03 March 2019. Apple informed the DPC that
the deletion was initiated across its systems on 21 March 2019. Apple
submitted that the deletion of the Apple ID does not mean that all data related
to the account had been erased. It submitted that it indicates clearly to data
subjects that some data may be retained. Apple submitted that following the
deletion of an Apple ID, it retains a one-way hash of the user's Apple ID email
address, the logs of the erasure request and the deletion event. Apple
submitted that it retains a one way hash of the email address, which is stored
with the deletion event, to ensure it has a record of having completed the
deletion request, enabling it to comply with its legal obligations and for security
purposes. Apple also stated that it also uses this hashed form in deciding
whether to decline the re-use of an email address but that it does not attempt
to extract the email address from the hashed value retained. Apple stated that
without retaining this value, it would not be able to prevent the recycling of
namespaces by users, or to protect its users against fraud and security
breaches by third parties seeking to use their email addresses to impersonate
the users, or to gain control over a name which has previously been associated
with an Apple ID account thereby creating a potential vulnerability in its
40
An Coimisiun um
Chosaint Sonraf
Data Protect ion
Commission
systems. Apple stated that the retention of this hashed value is specifically
highlighted to users seeking to delete their Apple ID and it submitted that it
does not attempt to extract the user's email address from the retained hashed
value. Apple noted the Complainant's assertion that it keeps a publicly
available encrypted version of his email address to prove that it has deleted his
account to comply with its legal obligations. Apple refuted this assertion, stating
that it does not retain a publicly available version of the Complainant's email
address but rather, that his email address is retained as a hashed value. Apple
stated that it also retains a DSID. It stated that the hash values of the relevant
email addresses are stored for as long as necessary.
122. Apple reiterated that it does not attempt to extract the user's email addresses
from the one way hash of the data retained . It further stated that it does not
seek to identify the DSID from those email addresses. Apple submitted that
following the completion of an erasure request, the personal data used by
Apple to verify the identity of a user with regard to his/her control of an Apple
ID is no longer retained by Apple. Apple stated that it is therefore not possible
for It to provide a copy of financial transaction records or other retained
information, as it does not have a means to verify the account holder's identity
without the account details that were deleted as part of the account deletion
process. Apple submitted that, as a result, it considers that the hashed values
in question do not enable it to identify the Complainant in accordance with
Article 12(6) of the GDPR.
123. The Complainant believes that Apple is able to extract his email address from
the hashed value and that Apple has not been transparent with him about the
retention and processing of this personal data in a hashed form. The
Complainant stated that Apple had not complied with his erasure request
because it is retaining this personal data forever. The Complainant queried the
reasoning for Apple retaining a hashed version of his email address to prove
that it deleted his account so as to comply with its legal obligations and he
disputed Apple's reasoning. The Complainant stated that he understands
Apple's requirement to audit deletion requests but he contended that there are
methods which are effective and less intrusive than retaining a hashed value
of his personal data. The Complainant stated that Apple's retaining of a hashed
value of his personal data creates a potential security risk to his personaldata
and in particular in respect of identity theft as opposed to being a security
measure to prevent identity theft. The Complainant stated that Apple was
retaining his email address and potentially additional personal data with his
email address and that Apple did not inform him that it would be retaining his
email address. The Complainant stated that he has had accounts deleted by
other providers and his email address was deleted entirely from their systems.
The Complainant submitted that Apple only needed to retain an encrypted log
41
An Coimisiun um
Chosaint Sonrai
Data Protection
Commission
of the deletion request and confirmation that it had been deleted. The
Complainant contended that Apple failed to properly comply with his erasure
request and that it has unlawfully retained personal data associated with his
account.
124. Article 17(1) of the GDPR states that "the data subject shall have the right to
obtain from the controller the erasure of personal data concerning him or her
without undue delay".
125. Article 5(1 )(a) of the GDPR states that "[p]ersonal data shall be processed
lawfully, fairly and in a transparent manner in relation to the data subject
('lawfulness, fairness and transparency?".
125. Article 4(1) of the GDPR states that "'personal data' means any information
relating to an identified or identifiable natural person ('data subjectJ; an
identifiable natural person is one who can be identified, directly or indirectly, in
particular by reference to an identifier such as a name, an identification
number, location data, an online identifier or to one or more factors specific to
the physical, physiological, genetic, mental, economic, cultural or social identity
of that natural person".
127. Recital 26 provides that "[t]he principles of data protection should apply toany
information concerning an identified or identifiable natural person. Personal
data which have undergone pseudonymisation, which could be attributed to a
natural person by the use of additional information should be considered to be
information on an identifiable natural person. To determine whether a natural
person is identifiable, account should be taken of all the means reasonably
likely to be used, such as singling out, either by the controller or by another
person to identify the natural person directly or indirectly. To ascertain whether
means are reasonably likely to be used to identify the natural person, account
should be taken of all objective factors, such as the costs of and the amount of
time required for identification, taking into consideration the available
technology at the time of the processing and technological developments. The
principles of data protection should therefore not apply to anonymous
information, namely information which does not related to an identified or
identifiable natural person or to personal data rendered anonymous in such a
manner that the data subject is not or no longer identifiable. This Regulation
does not therefore concern the processing of such anonymous information,
including for statistical or research purposes" .
1al. The DPC also notes that the Article 29 Working Party considered hashing to
be a technique for pseudonymization that "reduces the linkability of a dataset
with the original identity of a data subjecf' and that hashing "is a useful security
42
An Coimisiun um
Chosaint Sonraf
Data Protection
Commission
measure" but that it is "not a method of anonymization". Therefore, from the
perspective of the Article 29 Working Party, while hashing might be a useful
security technique, it is not sufficient to convert personal data into de-identified
data.
123. Taking all of the above into account, the DPC considers that Apple's retention
of a hashed value of the Complainant's email address constituted processing
of personal data as per the definition set out in Article 4(2) of the GDPR.
Retention of a hashed value of the Complainant's email address following the
erasure request based on legitimate interests
13). The DPC notes Apple's submission that it retains a hashed value of the
Complainant's Apple ID email address for as long as necessary on the basis
of its legitimate interests in accordance with Article 6(1 )(f) for the following
purposes: to demonstrate compliance with the user's request to delete their
Apple ID account under Article 17(1) of the GDPR; to allow it to show
compliance with its security obligations under Article 32 of the GDPR and in
addition to be able to prevent the recycling of namespaces by users, or to
protect its users against fraud and security breaches by third parties seeking
to user their email address to impersonate the user, or to gain control over a
name which has previously been associated with an Apple ID account thereby
creating what it determined to be a potential vulnerability in its systems.
131. The DPC notes that Apple claimed that deleting this data after a limited period
would re-open the security and compliance risks and create a vulnerability in
its systems. The DPC notes that Apple claimed that if this data was deleted
after a specified period, then this would essentially permit the recycling of
namespaces and the potential use of such namespaces by third parties for
fraudulent purposes. The DPC also notes that Apple claimed that it would also
mean that the evidence of deletion of a customer's Apple ID would be removed
and it would therefore have no record of its compliance with an individual's
deletion request in that respect.
132. The DPC notes Apple's submission that if it retained the logs of the
Complainant's erasure request without retaining the hash of the Complainant's
Apple ID email address then it would not have evidence that it complied with
the Complainant's specific erasure request and it would not have been able to
respond to the DPC's query in respect of the exact date Apple received the
Complainant's erasure request. The DPC notes that Apple also stated that
should it receive a query from a customer or from the DPC in relation to a
43
An Coimisiun um
Chosaint Sonraf
Data Protection
Commission
specific Apple ID, without retaining the hashed version of the email address it
would technically have no means to confirm that it deleted a specific Apple ID.
1:Il The DPC notes Apple's submission that email addresses are part of the unique
way that Apple IDs are identified for authentication, email and documentation
sharing purposes. as well as many other purposes.
13'1. The DPC notes Apple's submission that it carries out periodic reviews of its
retention practices including those subject to this complaint and that it was not
its intention to give the impression that it retains the data indefinitely without
further consideration. It stated that it is not its intention to retain the data in
question forever in any event without submitting this retention to a periodic
assessment.
1J5. The DPC notes Apple's submission that:
"The prohibition on re-using email addresses associated with a deleted
Apple ID is indeed a security measure. The hashed value of the
relevant email address and DSID are rendered using the [specific
algorithm]. If a hashed value of a deleted email address was not
retained, we believe that a nefarious third party could obtain access to
that email address perhaps through recycling or compromise and courd
create a new account using that email address and purchase Apple
services whilst impersonating the genuine user. Apple would thereby
be at risk of facilitating identity fraud rather than preventing it, as is the
intent of our current policies.·
133. Article 6(1 )(f) of the GDPR states that processing shall be lawful only if and to
the extent that "processing is necessary for the purposes of the legitimate
interests pursued by the controller or by a third party except where such
interests are overridden by the interests or fundamental rights and freedoms of
the data subject which require protection of personal data, in particular where
the data subject is a child'.
137. Recital 47 of the GDPR provides that • ... the existence of a legitimate interest
would need careful assessment including whether a data subject can
reasonably expect at the time and in the context of the collection of the
personal data that processing for that purpose may take place. The interests
and fundamental rights of the data subject could in particular override the
interest of the data controller where personal data are processed in
circumstances where data subjects do not reasonably expect further
processing ... The processing of personal data strictly necessary for the
purposes of preventing fraud also constitutes a legitimate interest of the data
44
&,
An Coimisiun um
Chosaint Sonraf
Data Protection
Commission
controller concemecf'.
1:£. It is important to note that the Complainant's email address was his Apple ID
and the usemame that he used to sign in to access Apple Services. Therefore,
his email address was initially collected and processed by Apple for the
purposes of using and accessing Apple Services. It is also important to note
that it is also the contact email address for his account.
1J;l. For a controller to rely on Article 6(1 )(f) of the GDPR to lawfully process
personal data, three conditions must be met:
Q) the controller or a third party must have a legitimate interest (legitimate
interest);
~) processing is necessary for the purposes of the legitimate interest
(necessary);
(i) such Interests are not overridden by the interests or fundamental rights
and freedoms of the data subject which require protection of personal
data (balance of interests).
1.«l. First condition: Legitimate interests. In its LIA, Apple referred to its
legitimate interests as:
• the interest of demonstrating compliance with the user's request to
delete, as per Article 17(1) of the GDPR, their Apple ID account;
• the interest of demonstrating compliance with its security obligations
under Article 32 of the GDPR, in accordance with the principle of
accountability under Recital 74 of the GDPR;
• the interest of preventing recycling of namespaces by users, or to protect
its users against fraud and security breaches by third parties seeking to
use their email address to impersonate the user, or to gain control over
a name which has previously been associated with an Apple ID account,
thereby creating what it has determined to be a potential vulnerability in
its systems.
141. The DPC agrees that Apple fulfils the first condition regarding the existence of
legitimate interests.
142. Second condition: Necessity. In its LIA, Apple stated the following with
regard to this condition:
45
An Coimisiun um
Chosaint Sonraf
Data Protection
.. Commission
143. Apple also stated the following with regard to this condition:
144. The DPC agrees that Apple fulfils the second condition with regard to
necessity.
145. Third condition: balance of interests. In its LIA, Apple stated that the
retention of this data is an expected behaviour which is specifically highlighted
to users seeking to delete their Apple ID and that when customers delete an
account using its Data & Privacy page at privacy.apple.corn, they are
presented with the Deletion Terms and Conditions. Apple stated that it had
taken a number of steps in order to limit the impact of the retention of this
personal data, such as data minimisation efforts and hashing. Apple stated that
a user could not reasonably consider this data processing to be excessive.
Apple stated that customers benefit from the limited processing of this data.
46
An Coimisiun um
Chosaint Sonra f
Data Protection
Commission
Apple stated that if a customer objects to the processing of their personal data
such as the one way hashed email address retained following the deletion of
an Apple ID account, it asks them to explain their interests so that it can assess
whether they override its legitimate interests in retaining this data; Apple stated
that thus far it has not received a case which it has determined meets that
criteria. Apple stated that it has used a number of safeguards and controls to
protect this personal data.
146. With regard to the third condition, balance of interests, the DPC is satisfied that
Apple's legitimate interests in retaining a hashed value of the Complainant's
email address are not overridden by the Complainant's interests or
fundamental rights and freedoms. The DPC is of the view that Apple has
demonstrated compliance with Article 6(1 )(f) of the GDPR for this data
processing.
147. On the basis of the foregoing, the DPC is satisfied that Apple validly relied on
Article 6(1)(f) of the GDPR as the lawful basis for retaining a hashed value of
the Complainant's email address in this particular case.
Issue B - The perjod for which Apple intends to retain the hashed value
of the Complainant's email address.
148. Article 5( 1)( e) of the GDPR states that ''personal data shall be kept in a form
which permits identification of data subjects for no longer than is necessary for
the p urposes for which the personal data are processed."
149. The DPC notes Apple's reference in rits submission to Recital 39 of the GDPR
which states, among other things, that "in order to ensure that the personal
data are not kept longer than necessary, time limits should be established by
the controller for erasure or for a periodic review."
1!:D. The DPC notes Apple's submission that it would like to clarify and elaborate on
its submission of 30 March, 2022 that it is not its intention to retain the data in
question forever in any event without submitting th is retention to a periodic
assessment. It stated that the ongoing retention of the hashed values is strictly
necessary to enforce its policy to prevent the reuse of an email address.
151. Taking Apple's submissions into account, and particularly that Apple has
clarified and elaborated that it is not its intention to retain the Complainant's
personal data indefinitely and that in instances such as this case it implements
longer periods of retention that are subject to periodic reviews, and that it
carries out periodic reviews of its retention practices, the DPC is satisfied that
Apple has given due consideration to the principle of data minimisation in
47
An Coimisiun um
Chosaint Sonrai
Data Protection
Commission
relation to the retention of the hashed value of the Complainant's email
address. In the circumstances, therefore, the DPC has not identified any
infringement of Article 5(1 )(e) in this case.
Issue C - Whether Apple met the requirements of Article 12(1) and Article
17(1) with regard to the processing of the Complainant's erasure request.
1~ Article 12{ 1) of the GDPR states that "[t]he controller shall take appropriate
measures to provide any information referred to in Articles 13 and 14 and any
communication under Articles 15 to 22 and 34 relating to processing to the data
subject in a concise, transparent, intelligible and easily accessible form, using
clear and plain language, in particular for any information addressed
specifically to a child''.
153. Article 12(2) of the GDPR states that "[t]he controller shall facilitate the exercise
of data subject rights under Articles 15 to 22. In the cases referred to in Article
11(2), the controller shall not refuse to act on the request of the data subject
for exercising his or her rights under Articles 15 to 22, unless the controller
demonstrates that it is not in a position to identify the data subject."
154. Article 12(3) of the GDPR states that "[t]he controller shall provide information
on action taken on a request under Articles 15 to 22 to the data subject without
undue delay and in any event within one month of receipt of the request. That
period may be extended by two further months where necessary, taking into
account the complexity and number of the requests. The controller shall inform
the data subject of any such extension within one month of receipt of the
request, together with the reasons for the delay. Where the data subject makes
the request by electronic form means, the information shall be provided by
electronic means where possible, unless otherwise requested by the data
subject.
1ffi. Article 17(1) of the GDPR states that "the data subject shall have the right to
obtain from the controller the erasure of personal data concerning him or her
without undue delay'.
100. The DPC notes that, on 03 March 2019, the Complainant made a valid erasure
48
An Coimisiun um
Chosaint Sonraf
Data Protection
Commission
request pursuant to Article 17 of the GDPR to Apple. The DPC notes that
Apple, upon receiving the request, informed the Complainant on the same date
that his Apple ID account would be deleted soon and that it was processing his
request. Apple informed the DPC that the deletion was initiated across its
systems on 21 March 2019. In this case , therefore, it is clear that Apple
provided the Complainant with information on the action taken in relation to his
erasure request within one month of receipt of the said request. The DPC is,
therefore, satisfied that Apple met the requirements of Articles 12 and 17 with
regard to the processing of the Complainant's erasure request in March 2019.
The issue of dispute that subsequently arose in 2021 related to the emergence
of the fact of the retention of the hashed value of the Complainant's email
address on foot of the processing of the erasure request. As stated above, the
DPC is satisfied that Apple validly relied on Article 6(1)(f) of the GDPR as the
lawful basis for retaining a hashed value of the Complainant's email address in
this particular case. Those actions did not, therefore, cause infringements of
Articles 12 and 17 by Apple with regard to the processing of the Complainant's
erasure request.
Issue D - Whether Apple complied with the principles of transparency and
the provision of information in terms of notifying the Complainant that a
hashed value of his email address was retained following the processing
of his erasure request.
157. As stated above, the erasure request in this case was submitted by the
Complainant in March 2019 and processed by Apple during that same month.
According to Apple, upon receiving the Complainant's query of 31 August 2021
Apple Privacy responded to him on 01 September 2021. It was on that
occasion that Apple first informed the Complainant of the retention of the
hashed value of his email address in the following terms: I would like to explain
that we are not retaining your email address but hold a one way hash of the
email address, which is stored with the deletion event to ensure we have a
record of having completed your request, to allow us to comply with our legal
obligations and for security purposes. We a/so use this hashed form in deciding
whether to decline the re-use of an email address. We do not attempt to extract
the email address from the hashed value retained.• The Complainant was,
therefore, not informed by Apple when it processed his erasure request of 3
March, 2019 that it retained a hashed value of his email address. It was only in
the context of the Complainant raising a query with Apple In August 2021
following his experience of unsuccessfully attempting to create a new Apple
account in order to manage his daughter's new phone, using his email address.
which had previously been associated with his own account with Apple, that
Apple informed him of the retention of the hashed value of his email address.
49
An Coimisi(m um
Chosaint Sonrai
Data Protection
, Commission
1ffi. The DPC notes that Apple does not consider that providing this level of detail
would be required or appropriate, considering the highly technical nature of this
aspect.
1$. While the DPC notes Apple's submissions in respect of its Privacy Policy
(marked updated 27 October 2021) including as stated above at paragraph 50,
its Apple ID & Privacy notice (updated on 01 February 2023), its Deletion Terms
and Conditions (effective date 30 August 2022) and the update made to the
'Delete your account' option on its Data and Privacy page (in particular, the text
"The email address that you use with your Apple ID account, [relevant email
address) will no longer be available for use with any new or existing Apple ID.
To ensure that it can't be used again, a record of this email address will remain
on file with Apple"), the DPC is of the view that in this Complainant's case the
information available in Apple's Privacy Policy 2018, the Privacy Policy in place
in 2019, did not contain all the information required by Article 13, in particular
Article 13(1)(c) of the GDPR. The DPC is of the view that, while ii may be
unambiguous that Apple will retain ·a record of the deleted account", the
information as set out In the relevant Privacy Policies is not specific or clear in
respect of the retention of the email address and the specific legal basis and
specific legitimate interests for doing so; such information, such as the
purposes of the processing for which the personal data are intended as well as
the legal basis for the processing and the legitimate interests (where
processing is based on point (f) of Article 6(1 )), in the opinion of the DPC,
should be provided to a data subject at the time when the personal data are
obtained.
100. During this Inquiry, Apple provided the DPC with a copy of a document entitled
"Apple ID Deletion Terms and Conditions" that were effective when the
Complainant submitted his erasure request in March 2019. At the time of
making an erasure request, Apple users were required to indicate that they
have read and agree to those terms and conditions. Among other things, the
terms and conditions document informed users that "If you choose to create a
new Account subsequently, you will need to use an email address that is not
associated with the Account you've requested we delete as we have to retain
a record of the deleted Account. If you would like to modify your Account before
proceeding with the deletion process, please log in to applied.apple.com.
However, you will be unable to remove the primary email address for the
Account."
161. As stated In Paragraph 16 above, during the complaint handling process, Apple
informed the DPC of its intention to update the Deletion Terms and Conditions
to clarify that where it deleted an account, it retains personal data to comply
with legal obligations such as where it needs to retain transaction information,
so
An Coimisiun um
Chosaint Sonrai
Data Protection
Commission
which may include personal data, for financial reporting purposes and for
account security purposes. This Inquiry was subsequently provided with a
document entitled "Apple ID Deletion Terms and Conditions" dated 30 August,
2022. Among other things, this document includes the following: "If you choose
to create a new Account later, you will need to use an email address that is not
associated with the Account you have requested we delete, because we need
to retain a record of the deleted account to comply with legal obligations and
for account security purposes, as described below. If you used a phone number
to create your Account, it cannot be used to create another Account for the
same reasons. To modify your Account before proceeding with the deletion
process, sign in to appleid.apple.com. Note that you will not be able to remove
the primary email address for the Account or the phone number if you used it
to create the account. ..... Where we delete an Account, Apple makes its best
efforts to delete all personal data associated with your Account. lfwe delete your
personal data, we will both render certain personal data about you permanently
unrecoverable and also de-identify certain personal data. We do retain personal
data to comply with legal obligations such as where we need to retain
transaction information, which may include your data for financial reporting
purposes and for account security purposes. We may also be required to retain
information to comply with a court settlement or other equivalent mandated
processes. Apple retains personal data only for so long as necessary to fulfil
the purposes for which it was created."
162. Article 13(1 )(c) of the GDPR states that where personal data relating to a data
subject are collected from the data subject, the controller shall, at the time
when personal data are obtained, provide the data subject with the purposes
of the processing for which the personal data are intended as well as the legal
basis for the processing.
1fil Article 13(1 )(d) of the GDPR states that where personal data relating to a data
subject are collected from the data subject, the controller shall, at the time
when personal data are obtained, provide the data subject with, where the
processing is based orn point (f) of Article 6( 1), the legitimate interests pursued
by the controller or by a third party. In the current case, the DPC takes the view
that when Apple processed the Complainant's erasure request of 3 March,
2019 and retained thereafter a hashed value of his email address, it was
obliged at that point to have complied with the requirements of Article 13(1 )(c)
and Article 13(1)(d). In that regard, Apple was obliged to inform the
Complainant that it would retain a hashed value of his email address and it was
obliged to properly inform him of the specific legal basis for so doing and
Apple's specific legitimate interests for so doing.
164. The DPC notes that Apple would consider that including "a record of the
51
An Coimisiun um
Chosaint Sonrai
Data Protection
Commission
deleted accounf' in Apple's Deletion Terms would more than convey that the
record would need to be such to allow for the account to be capable of being
identified in a specific set of circumstances. The DPC is of the view that, while
Apple's Deletion Terms in place in 2019 was unambiguous that Apple will retain
"a record of the deleted accounf', the information set out was not specific and
clear in respect of the retention of the email address and the specific legal basis
and specific legitimate interests for doing so. The information that Apple
submitted is now set out under the 'Delete your account' option on its Data &
Privacy page, in particular "The email address that you use with your Apple ID
account, [relevant email address] will no longer be available for use with any
new or existing Apple ID. To ensure thatit can't be used again, a record of this
email address will remain on file with Apple" (information added on 27 May
2022) is the type of information that should be included in Apple's Privacy
Policy, Deletion Terms and under the 'Delete your account' information. This
specific information was not made available to the Complainant in March 2019
when he made his erasure request. This type of information should be made
available to users prior to them requesting deletion/ taking steps to delete their
account and going forward should be made available to users at the time of
obtaining their email address.
1ffi Further, having examined the document entitled "Apple ID Deletion Terms and
Conditions" that were in effect when the erasure request was made in March
2019, as set out in Paragraph 160 above, it is clear that Apple did not inform
the Complainant that a hashed value of his email address would be retained.
While it referred to retaining "a record of the deleted Accounf' it made no
reference to the Complainant's email address and the retention of a hashed
value of it. Neither did Apple inform the Complainant of the legal basis and its
legitimate interests for retaining the hashed value of his email address.
Accordingly, the DPC has come to the view in this case that in the
absence of specifically infonning the Complainant when he made his
erasure request In March 2019 of its intention to retain a hashed value of
his email address, and the legal basis and legitimate interests for so
doing, Apple failed to meet the transparency requirements of Article
13(1)(c) and Article 13(1)(d) at thattime. The required information only came
to the Complainant's notice over two years later as a result of his own actions
in contacting Apple and lodging a complaint.
1ffi. By way of observation, the DPC notes that the updated version of the
document entitled "Apple ID Deletion Terms and Conditions" dated 30 August,
2022 (as described in Paragraph 161 above) does not specifically and clearly
set out that a user's email address, or the retention of a hashed value in relation
to it is retained by Apple in the circumstances of the deletion of an Apple
account. Apple does not currently make it clear that the retention period for
52
An C.oimisiun um
Chosaint Sonra1
Data Protection
Commission
hashed ,ema~I addresses is subject to periodic re iew.
Decis,ig,n_oruinfJjngements •Df the GiDJ?B
167. Fol.lowing the investigation of the complaint against Applie Dist~ibuUon
lnternationai Limited, the. DPC is of the opinion that in the circumstances .of
th·s CompJainanf's caset Apple Dtstribution lntem:ational: Umlted infringed tihe
Genera Data Protection Regulation as foHo,ws;
Arti~t~ 13:
l'n the abse·noe of specmcally infonning U1e Complainant when he made
his erasure•i'equest in March 2019 •of its intention to reta.in a ha·shed value
of his email addres$, and the l,e gal basis and legitimate int.e rests f:or so
doi,ng,. Apple failed to meet the· trans.parency requirements of Artie.le
13(1 )(c,) and Art1cte 13(1 )(d) at that time,.
Remedial meas,Ures undertaken by' Apple
1fil It is noted that users are pmvided w1it'h a summary of what deleting their
aooount wm mean in practice prior ·to, being: shown tne DeleUon Terms. Since
27 May 2022, selecting the 1De:ete your .a ccount' opt on on our Data ,& Privacy
pag,e which is the location users. are· di'rected to mak!e a111 erasure equ:est
leads users to the relevant text, rncludlng "The email address that you use with
your Apple I.D account (re:levant ema ·1 address] will no Jonger .be available for
use with any new or existing Apple ID. To e,nsure that it oan't be used again, a
record of this email address will remain on file with Apple" (added on 27 May
.2022).
Ex,ercise of C'•orrective, iPow,era by; the DPC
1m h1 deciding on the cor.r;ective powers that are to be exercised in respect of the
infringements of the GDPR outlined above, !I have had due regard to, the
Commission's power to impose administrative fines pu suant to Section 141 of
the 2018 Act. In part1icular, 1:have conside:red ftle crite,ria set out in Artici!e 83(2)
( a) - (k) of the ,GDPR. When imposing corrective powers, am obliged to select
the measures that are effective,, proportionate and dissuasive n response to
the particular lnfringement:s The assessment of what is effectiv,e,, proportion ate
and dissuas;ive must be made in the, context o,f the object v,e pursued 1 by the
corrective measurest for examp e fe-e:Stablishing compUanoe with the GDPR
,o r punishing unlawful behaviour (o,r boU1)5. I find that an administrative fine
0 S~e the Article 29 Data Protection Working Party 'G1.1TMH11,es on the appHcation a,ndl setting of admin,istrativ.e fines
fo the pLJrpose of Regulation 2016/679, at pag~·:n.
53
An Coimisiun um
Chosaint Sonrai
Data Protection
Commission
would not be necessary, proportionate or dissuasive in the particular
circumstances in relation to the infringements of the Articles of the GDPR as
set out above.
170. In light of the extent of the infringements identified above, the DPC
hereby issues a reprimand to Apple Distribution International Limited,
pursuant to Article 58(2)(b) of the GDPR
171. In light of the infringements of Article 13(1)(c) and Article 13(1)(d)
identified above in this Complainant's case and to prevent similar
infringements occurring with regard to data subjects in the future, the
DPC orders Apple Distribution International Limited pursuant to Article
58(2)(d) of the GDPR to review and revise its document entitled "Apple ID
Deletion Terms and Conditions" to address the transparency deficiencies
identified in this Decision. Specifically, that document should
additionally inform data subjects that, in the event of their making an
erasure request, Apple Distribution International Limited will retain a
hashed value of their email address, the retention period for which will
be subject to periodic review, and of the legal basis and legitimate
interests for doing so. Details of compliance with this order should be
provided to the DPC by Apple Distribution International Limited by 7 June
2024.
1Tl.
Judicial remedies with respect to Decision of the DPC
173. In accordance with Article 78 of the GDPR, each natural or legal person has
the right to an effective judicial remedy against a legally binding decision of a
supervisory authority concerning them. Pursuant to Section 150(5) of the Act,
an appeal to the Irish Circuit Court or the Irish High Court may be taken by a
data subject or any other person (this includes a data controller) affected by a
legally binding decision of the DPC within 28 days of receipt of notification of
such decision. An appeal may also be taken by a data controller within 28 days
of notification; under Section 150( 1) against the issuing of an enforcement
notice and/or information notice by the DPC against the data controller; and
under Section 142, against any imposition upon it of an administrative fine by
the DPC.
54
An Coimisiun um
ChosaintSonraf
Data Prote·c ttc n
Commission
Tony Delaney
Deputy Commissioner
On behaff of the Data Protection Commission
55