Apple is launching a major privacy push, with software updates across all its devices to introduce new data privacy information immediately, with an updated website offering new privacy management tools to follow in May.
Thursday’s updates (macOS 10.13.4, iOS11.3 and tvOS 11.3) are prompted by the enormous new European data protection regulation GDPR, and have been in the works since at least January. But they come at a good time for the company, whose head Tim Cook has been merrily capitalising on the Facebook/Cambridge Analytica scandal, publicly rebuking Mark Zuckerberg over the social network’s business model.
Q&AWhat is GDPR?
Show
The General Data Protection Regulation (GDPR), which came into force on 25 May 2018, replaced the patchwork of national data protection laws across the EU with a unified system that greatly increased the fines regulators could issue, strengthened the requirements for consent to data processing, and created a new pan-European data regulator called the European Data Protection Board.
The regulation governs the processing and storage of EU citizens' data whether or not the company has operations in the EU. To ensure companies comply, GDPR also gives data regulators the power to fine up to €20m, or 4% of annual global turnover. In the UK, the previous maximum fine was £500,000; the post-GDPR record currently stands at more than £180m, for a data breach reported by British Airways in 2018.
Data breaches must be reported within 72 hours to a data regulator, and affected individuals must be notified unless the data stolen is unreadable. Fines can also be levied against companies that act on data without explicit and informed user consent, or who fail to ensure that consent can be withdrawn at any time.
GDPR also refined and enshrined in law the concept of the "right to be forgotten", renaming it as the "right to erasure", and gave EU citizens the right to data portability, allowing them to take data from one organisation and give it to another.
For users of the company’s devices, the biggest change will be the introduction of a unified data privacy iconography, which now shows up alongside detailed information about how Apple uses personal data for its various first-party services. “Apple believes privacy is a fundamental human right,” the company will tell every user the first time they turn on their devices after the update, “so every Apple product is designed to minimise the collection and use of your data, use on-device processing whenever possible, and provide transparency and control over your information”.
Although the new features are prompted by GDPR, they are rolling out to users worldwide, and the company proudly notes that it has not had to change any of its software to comply with the new regulations. Unlike competitors such as Google, who operate on the principle that large scale data collection bestows an advantage in areas such as machine learning and transport planning, Apple has repeatedly argued that it has a responsibility to minimise data collection.
Speaking on Wednesday, Cook said “We could make a ton of money if we monetised our customers, if our customers were our product … We’ve elected not to do that. We’re not going to traffic in your personal life. Privacy to us is a human right, a civil liberty.”
In May, shortly before GDPR takes effect, Apple will also update its website to make it easier for users to exercise four key rights granted by the regulation: getting a copy of their data; requesting a correction to their data; deactivating their accounts; and deleting their accounts.
The company sees an opportunity to distinguish from competitors there too: deactivation, in particular, is a much stronger implementation than in other platforms. It removes the user’s information from all aggregated data stores, isolating their accounts but stopping short of deleting them.