Let's form the issue here using an example from the regulation: A bank holds personal data about its customers. This includes details of each customer’s addres

Let's form the issue here using an example from the regulation: A bank holds personal data about its customers. This includes details of each customer’s address, date of birth and mother’s maiden name. The bank uses this information as part of its security procedures. It is appropriate for the bank to retain this data for as long as the customer has an account with the bank. Even after the account has been closed, the bank may need to continue holding some of this information for legal or operational reasons for a further set time. Based on that, I'd suggest its entirely reqasonable to posit: An online app store holds personal data about it's customers. This includes payment information and a list of apps that have been purchased, including free apps, and which of those apps have been downloaded. It is appropriate for the app store to maintain this information so they can allow the customer to install apps on their devices and link in app purchased made in those apps to the correct account. Even after the app has been removed from a device, the app store may need to continue holding some of this information for legal and/or operation reasons. Arguing that app store purchases are sensitive is some what missing the wood for the trees. What matters is what is done with the information. If Apple (or Google, Sony and Microsoft - they all run similar stores) use this in an attempt to target app store recommendations, the negative inpact on the individual is extremely debatable, certainly from the point-of-view of GDPR. If they are using the information to build a profile of an individual to sell access to that individual to 3rd parties, then there is a problem.