3 ms·
Art. 5: Personal data shall be: kept in a form which permits identification of data subjects for no longer than is necessary for the purposes for which the pe
by jdietrich 8y ago
Art. 5:
Personal data shall be:
kept in a form which permits identification of data subjects for no longer than is necessary for the purposes for which the personal data are processed
Recital 39:
The personal data should be adequate, relevant and limited to what is necessary for the purposes for which they are processed. This requires, in particular, ensuring that the period for which the personal data are stored is limited to a strict minimum.
The GDPR is very explicit on this point. You must delete or thoroughly anonymise personal data as soon as is practically possible.
https://gdpr-info.eu/art-5-gdpr/ https://gdpr-info.eu/art-5-gdpr/
https://gdpr-info.eu/recitals/no-39/ https://gdpr-info.eu/recitals/no-39/
- zerostar07 8y agoYes it's quoted in the article too, however "necessary for the purposes" is subject to interpretation, and there is a huge leeway here. In practice it is always possible to claim that some procedure would require retention for longer, and it would be impossible to have them prosecuted for that.
- ocdtrekkie 8y agoIf they divvy up a monthly fee to the sites you visit, they're going to have a hard time explaining the need to keep your browsing data more than a single month: Enough time to pay out to the websites. Then you can maybe add a couple months to account for backups and the like. It sounds like trimming the data retention here was well-warranted, particularly given the high sensitivity of browsing data.