Apple Threatened with a Fine of IDR 98.3 Billion for Not Complying with EU Privacy Requirements

JAKARTA - Apple must face a fine of 6 million euros (IDR 98.3 BILLION) for violating privacy rules. The recommendation emerged from the lead adviser to the French data protection authority's sanctions agency on Monday, December 12.

The CNIL sanctioning body is free to ignore a reporter's recommendations, but this usually has a lot to do with the inspector's final decision.

The whistleblower, Francois Pellegrini, made his recommendations after an investigation by the authorities, sparked by a complaint filed last year by the France Digitale lobby group.

In the complaint, the lobby, which represents mostly French digital entrepreneurs and venture capitalists, alleged that Apple's previous operating software, iOS 14, did not comply with EU privacy requirements.

France Digitale then argued that while iPhone owners were asked under iOS 14 whether they were prepared to allow installed mobile apps to collect key identifiers used to define campaign ads and deliver targeted ads, the default setting allows Apple to bring its own targeted ad campaigns without clarity for request prior approval from iPhone users.

Apple's privacy update, called App Tracking Transparency, gives users the option to block apps from tracking activity across apps and websites owned by other companies.

In his remarks, Pellegrini said Apple's previous iOS 14.6 operating system failed to properly request user consent for the collection of personal data, thus constituting a breach of privacy rules under the European Union's ePrivacy directive.

He added that changes made under the next version of Apple's operating system, iOS 15, allow for prior approval.

Gary Davis, Apple's head of privacy, challenged the complainants' conclusions at trial. He said the US company remains committed to protecting user privacy.

"The lack of seriousness of the offense means that the amount of the fine should be reduced," Davis said, as quoted by Reuters. He also asked that the amount of the fine not be published.

The CNIL sanctions agency did not say when it would reach a final decision on this.