Apple Inc.

Apple Response European Commission call for evidence on the Application of the General Data Protection Regulation (GDPR) Brussels, 8 February Apple welcomes the opportunity to comment on the European Commission’s call for evidence on the application of the General Data Protection Regulation (GDPR). As the Commission prepares the 2024 report in line with Article 97 GDPR, Apple remains as committed as ever to upholding our users’ privacy and data protection rights in everything we do. Apple was one of the few companies that was a staunch supporter of the GDPR from the beginning, as it was debated and as it came into effect. That remains even more the case today. The EU needs a strong and functioning GDPR to continue demonstrating global leadership on data protection. Apple’s Approach to Privacy Privacy is a fundamental human right, and one of our core values at Apple.

…data protection. Apple’s Approach to Privacy Privacy is a fundamental human right, and one of our core values at Apple. It is built into all of Apple’s products and services from the ground up, from the moment users open their devices to every time they use one of our apps. We design our products and services guided by our four key privacy principles: • Data Minimisation: Where processing of personal data is necessary, collecting only the minimum amount required to deliver what users need for a given service, using random identifiers not linked to identity wherever possible. • On-Device Processing: Processing data on the user’s device, wherever possible, rather than sending it to Apple servers, to protect user privacy and minimise data collection. • User Transparency and Control: Making sure that users know what data is shared, how it is used, and that they can exercise control over it.

Control: Making sure that users know what data is shared, how it is used, and that they can exercise control over it. • Security: Hardware and software working together to keep data secure. At Apple, we believe that you can have great products and secure data, which is why we have a long track record as a data protection leader, with innovations that give people more insight into how their data is used — and more tools to protect their data. Apple does not depend on the collection and monetisation of personal data — its business is to sell products and related services, not its customers' personal data. To deliver on its promise to customers, Apple has consistently set the industry standard for safeguarding user safety and data protection. We pioneered the use of strong encryption, from device-based encryption to end-to-end encryption in iMessage, FaceTime and iCloud.

…the use of strong encryption, from device-based encryption to end-to-end encryption in iMessage, FaceTime and iCloud. These features have been designed to ensure that our customers’ data remains truly private, including from Apple. We have built robust transparency and empowerment tools such as App Tracking Transparency and Privacy Nutrition Labels. We also deploy industry-leading consent mechanisms to allow our customers to make informed decisions on whether to share data such as their location, contacts, reminders, photos, bluetooth sharing, microphone, speech recognition, camera, health, HomeKit, media & Apple Music, and motion & fitness Data, and more with apps. Ref. Ares(2024)956458 - 08/02/2024 The GDPR has ignited a global change in the protection of personal data.

…with apps. Ref. Ares(2024)956458 - 08/02/2024 The GDPR has ignited a global change in the protection of personal data. Numerous countries and territories have introduced their first omnibus data protection laws, and individuals are increasingly aware of their fundamental right to privacy. The GDPR has been a compass for legislators worldwide on how to implement an effective system of individual rights that is sufficiently modern and adaptable to the dynamism of data flows and the digital economy. At Apple, the GDPR has served as an essential inspiration for our global privacy and data protection compliance and has informed our thinking when implementing our key privacy principles in our products and services.

…compliance and has informed our thinking when implementing our key privacy principles in our products and services. Privacy Governance Apple has implemented a comprehensive cross-functional privacy governance structure that covers all areas of the company and includes both customer and employee data. Our legal team has a vice president in charge of privacy and law enforcement compliance who reports directly to Apple's General Counsel. Apple also has a privacy engineering team that partners with the privacy legal team and dedicated product counsel to design products from the ground up to protect customer privacy and to ensure that we protect that data as long as it remains under our control. This includes robust processes to ensure data collected is used only for the intended lawful purposes.

…our control. This includes robust processes to ensure data collected is used only for the intended lawful purposes. We set up a Privacy Steering Committee chaired by our General Counsel, with members including our Senior Vice President of Machine Learning and AI Strategy and a cross-functional group of senior representatives from Internet Software and Services, Software Engineering, Product Marketing, Corporate Communications, Information Services & Technology, Information Security, Privacy Legal, and the Head of Business Assurance. The Privacy Steering Committee sets privacy standards for teams across Apple and acts as an escalation point for addressing privacy compliance issues for decision or further escalation. General Data Protection Regulation Apple was one of the few companies that supported the GDPR from the outset.

General Data Protection Regulation Apple was one of the few companies that supported the GDPR from the outset. We share its goal to provide the highest standard of transparency, control and protection of user data. We have promoted and advocated for similar comprehensive legal frameworks in the United States and throughout the world. We take pride in offering GDPR individual rights to our users globally. At Apple, we respect our user’s ability to know, access, correct, transfer, restrict the processing of, and delete their personal data. These rights are available to our global customer base, regardless of where they are located.

…their personal data. These rights are available to our global customer base, regardless of where they are located. The GDPR’s seven principles of lawfulness, fairness, and transparency; purpose limitation; data minimisation; accuracy; storage limitations; integrity and confidentiality; and accountability have remained relevant even as new technologies and societal developments have emerged. We therefore believe that a broad reopening or revision is not needed at this point, and support the Commission’s Proposal for a Regulation on GDPR Procedural Aspects as adopted on 4 July 2023 as the appropriate mechanism and set of rules for further strengthening GDPR cooperation and consistency. The GDPR has brought about many improvements in data protection standards, and we need to be careful to ensure that any updates do not send us backwards.

…in data protection standards, and we need to be careful to ensure that any updates do not send us backwards. Any reforms must not lead to an undermining of the One Stop Shop (OSS) in its practical application, which could negate any added value of the mechanism. We should also be mindful of avoiding any attempts to re-do European Court of Justice Rulings which some in industry are seeking, to provide a legal basis for personal data uses that do not reflect the highest standards of data protection. Apple does not support such an opportunistic approach that would set back the GDPR. Specific comments • An efficient and well-functioning one-stop shop (OSS), supported by a strong cooperation mechanism remains a core pillar in the success of the framework.

…one-stop shop (OSS), supported by a strong cooperation mechanism remains a core pillar in the success of the framework. It ensures consistency in application, provides legal certainty, and allows the framework to be scalable for small and large organisations alike. Like all new systems, there have been some challenges regarding different national administrative procedures, the conflicting interpretations of concepts relating to the cooperation mechanism as well as the diverging approaches of the Lead Supervisory Authorities and we fully support initiatives that seek to streamline and address these issues. Such challenges are expected, and this opportunity should be taken to make necessary improvements. It is also worth recalling that the fundamental role of a Supervisory Authority is to promote respect for the GDPR.

It is also worth recalling that the fundamental role of a Supervisory Authority is to promote respect for the GDPR. This function is best exercised where the Supervisory Authority fulfils its responsibility as an arbiter of the law — and not of the parties. This unbiased position is necessary for the proper application of the GDPR and respect for fundamental rights. • We encourage the Commission to continue developing and expanding the tools to allow for safe international data transfers. In today’s globalised economy, the ability for data to move freely across jurisdictions that share the same values is fundamental. Businesses rely on legal tools that are scalable and sustainable and which provide legal certainty. EU citizens, in turn, need to be able to trust that their data is afforded an equivalent level of protection regardless of where it is located.

15 → 12

originalus šaltinis (PDF) ↗