If you need help understanding the types of data that you and/or third party partners collect from your app, our specialist data protection solicitors will be happy to help.
Here we'll be explaining:
- Outline of data and privacy requirements on the Apple App Store
- The GDPR and privacy policies – why do they matter?
Outline of data and privacy requirements on the Apple App Store
The GDPR and privacy policies – why do they matter?
The GDPR giviesusers or ‘data subjects’ much greater say over what is done with their data. Essentially, if you are processing someones’ data, then they have a right to know why and what you are doing with and with whom you share it with.
Apple has been clear in its App Store Review Guidelines that there are additional rules on privacy which will need to be complied with. dependent upon what the app does and the type of data being collected:
- Accesses user or device/usage data: in this case prior consent must be gained for the collection of this data (data including calendar, location and contacts) and paid functionality cannot be withheld if a user does not consent.
- Offers an account registration process or accesses a user’s existing account: such as food shopping with a supermarket online, where you will need to insert personal data such as name address and payment details to register.
- Contains auto-renewable subscriptions or free subscriptions: will have additional considerations relating to consent of users to retain personal data.
- Uses the HomeKit or HealthKit Framework apps hat utilise ARKit, Camera APIs, Photo APIs, or other software for depth of facial mapping information, as this is personal data which can easily identify an individual.
- Collects and/or processes Health fitness and medical data:
- Where an App includes health, fitness and medical data, because the data is especially sensitive Apple makes clear that apps must not disclose data to third parties for advertising, marketing or any purpose other than for improving health management or for the reason data was collected, if permission is given by the user whose data it is.
- Apps must not add false or inaccurate data in any medical research or health management apps, and personal health information cannot be stored in iCloud.
- Consent must be obtained from the individual (or their parent or guardian if they are a minor) if an app is carrying out health-related research. For the consent to be informed and so valid the individuals should be told about the nature, purpose and length of research, the procedures, risks and benefits for the individual, confidentiality and how their data will be handled or passed on to, a point of contact and how to withdraw consent.
- Health related research requires prior approval for the app from an independent ethics review board.
- Integrates Apple Pay: Apps using Apple Pay can only share user data acquired via Apple Pay with third parties to facilitate or improve delivery of goods and services.
- Includes keyboard extensions: as there may be additional security considerations here.
- Appears in the ‘Kids Category’:
- Apple refers to the Children’s Online Privacy Protection Act (COPPA) and the GDPR in particular, and states that regardless of a person’s age some functionality or entertainment must be provided and so birthdate and parent contact information should only be requested where necessary by law.
- It's worth noting that the ICO children's code provides a set of standards in how the UK GDPR would apply to children using online services.
- Location services: These should only be used in an app when required for the features and services provided for the app to work, and should not be used for emergency services, to control vehicles or other devices (other than small devices such as drones). However, where they are allowed to be used you must clearly explain what any location data will be collected for and gain prior consent before collecting or processing location data.
For specific advice relevant to your particular business, contact our specialist data protection lawyers and we will be happy to help.
- Identify what data, if any, the app collects, how it collects that data, and all uses of that data.
- Explain its data retention and deletion policies and describe in an accessible and clear way, how a user can revoke consent and/or request deletion of their data.
If you would like further guidance on how to draft compliant privacy policies, you can contact our data protection specialist lawyers for advice.
Apple is the world’s most valuable company and has made it clear in recent years that customer privacy issues are a matter it takes seriously. Apple states in its App Store Review Guidelines that ‘protecting user privacy is paramount in the Apple ecosystem’ and 5.1 of those guidelines explicitly state that ‘developers that use their apps to surreptitiously discover passwords or other private data will be removed from the Developer Program and Apps that share user data without user consent or otherwise complying with data privacy laws may be removed from sale and may result in your removal from the Apple Developer Program’.
Apple has attempted to best protect user data privacy by drawing fire from law enforcers by planning to allow automatic encryption. This will close a security leak which allows police to access suspects’ iPhones. Apple are putting privacy first here, even to the extent that some argue it compromises national security.
It is prudent for Apple to be concerned, as although app developers are ultimately responsible for their users’ data, some responsibility lies with the platform where an app is hosted. Policies of platforms are being questioned and platforms are being held accountable for data misuse linked to apps they host.
As part of Apple’s ‘App Store Improvements process’, Apple is removing apps that no longer function as intended, don't follow current review guidelines, or are outdated.
Apple’s App Store Review Guidelines also mention permission and data use and sharing in 5.1, many of which are requirements under the GDPR, particularly in terms of gaining prior consent from users before collecting their data, clearly setting out how any user data will be used and how a user can easily withdraw consent, but also setting out the following:
- Data minimisation: Only data necessary for the core functionality of an app should be collected and used and should only be used for the purpose it was collected. The out-of-process picker or a share sheet should be used where possible rather than full access to protected resources (for example, photos, contacts, calendar).
- Access: Consent of users must be gained and respected, not overstepped. Users should not be manipulated into giving consent and if consent is not given you might instead consider an alternative (for example, if no consent is given to saving payment details, allow for these to be input manually).
- Signing in to an account: Unless there are a great deal of account-based features allow users to use the app without a log-in. If core app functionality is not linked to a specific social network, you must provide access without a login or via another mechanism. The app must also allow a user to revoke social network credentials and from within the app, block data between the app and social network. An app cannot store credentials or tokens to social networks off of the device and may only use those credentials or tokens to directly connect to the social network from the app, while the app is in use.
- SafariViewController: Where Safari is used within an app, this cannot be used to track users without their consent and the controller must not be hidden.
- Data use and sharing: Unless otherwise permitted by law consent must be gained before collecting, processing or sharing personal data of users. Data can only be used for the purpose it was collected unless consent has been given for the change of purpose or legislation specifically allows for it. Data collected from apps can only be shared with third parties to improve an app or advertising so long as this is compliant, information about what other apps are installed on a user’s device is not permitted for this purpose for your own use or that of a third party. You cannot use information from an individual user’s device (for example, contacts or photos) to build a database of contacts for you or any third party, contact may only be made on this basis after explicit consent by the individual user being contacted.
- Anonymity: If data has been collected anonymously it should be kept that way and not joined with other data to allow a user to become identifiable by you or any third party.