Forum

Forum Navigation
You need to log in to create posts and topics.

RetentionPolicy

We propose to add RetentionPolicy as a subtype of InformAction.

I think a Retention policy is a type of legal document as it binds the platform.

 

Under Art.13.2(a) controllers need to provide information regarding the period for which the personal data will be stored, or if that is not possible, the criteria used to determine that period;

Following the principles relating to the processing of personal data (Art. 5), personal data shall be kept in a form which permits identification of data subjects for no longer than is necessary for the purposes for which the personal data are processed; personal data may be stored for longer periods insofar as the personal data will be processed solely for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes in accordance with Article 89(1) subject to implementation of the appropriate technical and organisational measures required by this Regulation in order to safeguard the rights and freedoms of the data subject (‘storage limitation’);

The above principle conduces the need for a retention policy describing storage periods per processing activity and further documentation in regard to technical and organisational measures, purpose of processing, legal basis. In practice data controllers simply state a one size fits all retention period.

Either way we should include a) whether they provide info in regard to the storage period and b) whether they do have a retention policy. If the answer on b) is yes then we go further down.

Ok, thanks. So I guess we can consider it as a legal document. I put it as a subtype of the legaldocument type : http://www.legicrowd.org/schema/schemaedit.php?id=60