This is a clear violation of GDPR. The GDPR emphasizes the right to erasure (Article 17) and data minimization (Article 5). These principles require that personal data be:

* Kept for no longer than necessary * Deleted upon request or when no longer needed

Both of these conditions are met when someone "deletes" a picture from their device.

This bug basically proved that Apple is non compliant with this and there's no way that EU is going to ignore this big of a violation. If found guilty then they can fine Apple 20 million euros or 4% of global turnover(revenue) which is > $4 billion.

Is that also true even if the data is only on customer-owned hardware and not stored in the cloud?

Protections under GDPR apply to both local storage and cloud storage.

In this case both local storage and cloud storage are provided by same company so that distinction doesn’t matter but this storage location agnostic coverage of GDPR comes in handy on Android.

Hmm I sense a business opportunity of selling “GDPR compliant” GNU rm.

As per the article, this isn't specific to iCloud:

> This could be more innocent than it sounds. Computer data is never actually “deleted” until it’s overwritten with new 1s and 0s — operating systems simply cut off references to it. One user also said they saw a photo return even though they don’t sync their phone or use iCloud, implying the photos could be originating from on-device storage.

Except, the computer needs to know where to point to to read the data. So why are they keeping the index/inode around? Unless they're doing some unrequested data recovery to find these files?

Yup, exactly. If it's removed from the index it won't just show up again one day. This tells me that that innocuous explanation is not what's going on here.

On the Reddit threads, there are also users reporting photos returning after being deleted from a different Apple device of a different type— Even when the original device did not have ICloud enabled.

It's very odd. For it to be a local storage issue, it seems like IOS would have to be copying entire disk images across devices and accidentally doing file carving on freed resources. So I think ICloud is the most plausible technical explanation currently. At the same time, a cloud storage issue implies either malice or incompetence at a level that we currently only have indirect evidence of.