DPA case Inquiry into Apple Distribution International Limited - March 2024 – Complaint Upheld (Ireland, 2024)

On 3 March 2019, a data subject made an erasure request to Apple (the controller) in respect of his Apple ID. The controller confirmed that it was handling the erasure request and stated that when the account was deleted, the data stored with Apple would also be permanently erased. However, the controller continued to retain a hashed value of the data subject’s email address. It did not inform the data subject that it would retain this data. The data subject later attempted to create a new Apple account using his email address, and was notified by Apple that the email address could not be used as it was already linked to another Apple account. Realising his deletion request had not been honoured, the data subject filed a complaint with the Irish Data Protection Commission (DPC) on 25 October 2021. The DPC commenced an inquiry in November 2022. In response to the complaint, the controller submitted that it had retained this data for the purposes of its legitimate interests, including to be able to demonstrate compliance with its security obligations under Article 32 GDPR, prevent recycling of namespaces by users, protect users against fraud and security breaches by third parties, and demonstrate compliance with a user’s request to delete their Apple ID. While the period of retention was not yet certain, the controller informed the DPC that it convened with its security teams to review the period for deletion at some fixed time. The DPC’s inquiry considered the following: * Whether the controller had a lawful basis for retaining the hashed email address after an Article 17 GDPR erasure request had been made; * The period for which the controller intends to retain the hashed email address; * Whether the controller met the obligations in Articles 12(1) and 17(1) GDPR in processing the erasure request; * Whether the controller complied with principles of transparency in terms of notifying the data subject of the retention of the hashed email value. The DPC found that