So, what's the GDPR say about the backend keeping photos or voicemails that the user "deleted" years ago— And doing so inaccessibly and in secret from the user?
> This could be more innocent than it sounds. Computer data is never actually “deleted” until it’s overwritten with new 1s and 0s — operating systems simply cut off references to it. One user also said they saw a photo return even though they don’t sync their phone or use iCloud, implying the photos could be originating from on-device storage.
It's very odd. For it to be a local storage issue, it seems like IOS would have to be copying entire disk images across devices and accidentally doing file carving on freed resources. So I think ICloud is the most plausible technical explanation currently. At the same time, a cloud storage issue implies either malice or incompetence at a level that we currently only have indirect evidence of.
* Kept for no longer than necessary * Deleted upon request or when no longer needed
Both of these conditions are met when someone "deletes" a picture from their device.
This bug basically proved that Apple is non compliant with this and there's no way that EU is going to ignore this big of a violation. If found guilty then they can fine Apple 20 million euros or 4% of global turnover(revenue) which is > $4 billion.
In this case both local storage and cloud storage are provided by same company so that distinction doesn’t matter but this storage location agnostic coverage of GDPR comes in handy on Android.