4 ms·

So, what's the GDPR say about the backend keeping photos or voicemails that the user "deleted" years ago— And doing so inaccessibly and in secret from the user?

busymom0 2y ago
As per the article, this isn't specific to iCloud: > This could be more innocent than it sounds. Computer data is never actually “deleted” until it’s overwritten with new 1s and 0s — operating systems simply cut off references to it. One user also said they saw a photo return even though they don’t sync their phone or use iCloud, implying the photos could be originating from on-device storage.
- jmholla 2y ago
  Except, the computer needs to know where to point to to read the data. So why are they keeping the index/inode around? Unless they're doing some unrequested data recovery to find these files?
  - friend_and_foe 2y ago
    Yup, exactly. If it's removed from the index it won't just show up again one day. This tells me that that innocuous explanation is not what's going on here.
- Intralexical 2y ago
  On the Reddit threads, there are also users reporting photos returning after being deleted from a different Apple device of a different type— Even when the original device did not have ICloud enabled. It's very odd. For it to be a local storage issue, it seems like IOS would have to be copying entire disk images across devices and accidentally doing file carving on freed resources. So I think ICloud is the most plausible technical explanation currently. At the same time, a cloud storage issue implies either malice or incompetence at a level that we currently only have indirect evidence of.
noiseinvacuum 2y ago
This is a clear violation of GDPR. The GDPR emphasizes the right to erasure (Article 17) and data minimization (Article 5). These principles require that personal data be: * Kept for no longer than necessary * Deleted upon request or when no longer needed Both of these conditions are met when someone "deletes" a picture from their device. This bug basically proved that Apple is non compliant with this and there's no way that EU is going to ignore this big of a violation. If found guilty then they can fine Apple 20 million euros or 4% of global turnover(revenue) which is > $4 billion.
- ballenf 2y ago
  Is that also true even if the data is only on customer-owned hardware and not stored in the cloud?
  - noiseinvacuum 2y ago
    Protections under GDPR apply to both local storage and cloud storage. In this case both local storage and cloud storage are provided by same company so that distinction doesn’t matter but this storage location agnostic coverage of GDPR comes in handy on Android.
    - doublepg23 2y ago
      Hmm I sense a business opportunity of selling “GDPR compliant” GNU rm.

busymom0 2y ago

As per the article, this isn't specific to iCloud: > This could be more innocent than it sounds. Computer data is never actually “deleted” until it’s overwritten with new 1s and 0s — operating systems simply cut off references to it. One user also said they saw a photo return even though they don’t sync their phone or use iCloud, implying the photos could be originating from on-device storage.

jmholla 2y ago
Except, the computer needs to know where to point to to read the data. So why are they keeping the index/inode around? Unless they're doing some unrequested data recovery to find these files?
- friend_and_foe 2y ago
  Yup, exactly. If it's removed from the index it won't just show up again one day. This tells me that that innocuous explanation is not what's going on here.
Intralexical 2y ago
On the Reddit threads, there are also users reporting photos returning after being deleted from a different Apple device of a different type— Even when the original device did not have ICloud enabled. It's very odd. For it to be a local storage issue, it seems like IOS would have to be copying entire disk images across devices and accidentally doing file carving on freed resources. So I think ICloud is the most plausible technical explanation currently. At the same time, a cloud storage issue implies either malice or incompetence at a level that we currently only have indirect evidence of.

noiseinvacuum 2y ago

This is a clear violation of GDPR. The GDPR emphasizes the right to erasure (Article 17) and data minimization (Article 5). These principles require that personal data be: * Kept for no longer than necessary * Deleted upon request or when no longer needed Both of these conditions are met when someone "deletes" a picture from their device. This bug basically proved that Apple is non compliant with this and there's no way that EU is going to ignore this big of a violation. If found guilty then they can fine Apple 20 million euros or 4% of global turnover(revenue) which is > $4 billion.

ballenf 2y ago
Is that also true even if the data is only on customer-owned hardware and not stored in the cloud?
- noiseinvacuum 2y ago
  Protections under GDPR apply to both local storage and cloud storage. In this case both local storage and cloud storage are provided by same company so that distinction doesn’t matter but this storage location agnostic coverage of GDPR comes in handy on Android.
  - doublepg23 2y ago
    Hmm I sense a business opportunity of selling “GDPR compliant” GNU rm.