The GDPR establishes the principle of retention limitation among its principles of lawfulness.
Among the legal bases that set out these principles, the consent of the data subject plays a significant role.
Among the legal bases that define these principles, the consent of the data subject plays a significant role.
There are many questions about data retention and consent to processing, including:
- How long should data be retained?
- How is this duration indicated?
- Does consent have a duration, or does time affect its validity?
- Do the duration of data and consent coincide?
- What are the guidelines in the context of marketing?
Issues relating to the duration of consent, especially in the context of processing for marketing purposes, play a crucial role in ensuring lawful, fair, and transparent processing. This episode aims to analyze these aspects.
Principle of storage limitation
The principle of storage limitation, enshrined in Article 5(1)(e) of the GDPR, stipulates that personal data must be stored in a form that allows the identification of data subjects for no longer than is necessary for the purposes for which they are processed. This principle is closely related to the principles of purpose limitation and data minimization, as it aims to ensure that data is not stored indefinitely or for purposes that are incompatible with the original purposes.
Therefore, the data retention period is closely linked to the purpose according to the principle of necessity.
Recital 39 of the GDPR emphasizes the obligation for the controller to ensure that the period for which personal data are stored is limited to the minimum necessary. To that end, the controller should establish a time limit for erasure or for regular review to ensure that personal data are not kept for longer than necessary. There are some exceptions to the principle of storage limitation. Article 5(1)(e) provides that personal data may be stored for longer periods provided that they are processed solely for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes in accordance with Article 89(1) and subject to implementation of the appropriate technical and organizational measures required by the Regulation in order to safeguard the rights and freedoms of the data subject. Such measures may include pseudonymization.
