Inquiry into Apple Distribution International Limited | Data Protection Commission

• Judgment Date: 07 March 2024
• Case Outcome: On 7 March 2024, following an inquiry in relation to a complaint received against Apple Distribution International Limited (Apple), the Data Protection Commission (DPC) adopted a decision.
• Year: 2024
• Date: 07 March 2024
• Section: Decisions made under data protection act 2018

Inquiry into Apple Distribution International Limited - March 2024

Date of Decision: 7 March 2024

On 7 March 2024, following an inquiry in relation to a complaint received against Apple Distribution International Limited (Apple), the Data Protection Commission (DPC) adopted a decision.

The DPC commenced this inquiry on 2 November 2022 on foot of a complaint that Apple did not give effect to the Complainant’s rights and did not properly comply with its obligations under the GDPR. The Complainant contended that Apple failed to properly comply with an erasure request he submitted and had unlawfully retained certain personal data, in particular his email address.

The Complainant had made an erasure request to Apple in respect of his Apple ID on 3 March 2019. Apple confirmed to the Complainant on the same date that it was handling the erasure request to delete his Apple ID. This confirmation set out that, when the account was deleted, the data stored with Apple would also be permanently deleted. The Complainant was not informed by Apple at the time the erasure request was processed that it had retained a hashed value of his email address.

Apple submitted that it had retained a hashed value of the Complainant’s email address on the basis that the processing was necessary for the purposes of its legitimate interests, including in order to be able to demonstrate compliance with its security obligations under Article 32 of the GDPR; to prevent the recycling of namespaces by users; to protect its users against...