Don't blame me, blame the EU/ICO -I'm sure you'll try and think of another obstacle though....
(Source: https://www.dpnetwork.org.uk/gdpr-data-retention-guide/)The emphasis under the GDPR is data minimisation, both in terms of the volume of data stored on individuals and how long it’s retained.
To summarise the legal requirements, Article 5 (e) of the GDPR states personal data shall be kept for no longer than is necessary for the purposes for which it is being processed. There are some circumstances where personal data may be stored for longer periods (e.g. archiving purposes in the public interest, scientific or historical research purposes).
Recital 39 of the GDPR states that the period for which the personal data is stored should be limited to a strict minimum and that time limits should be established by the data controller for deletion of the records (referred to as erasure in the GDPR) or for a periodic review.
Or
Source: https://ico.org.uk/for-organisation...egulation-gdpr/principles/storage-limitation/At a glance
- You must not keep personal data for longer than you need it.
- You need to think about – and be able to justify – how long you keep personal data. This will depend on your purposes for holding the data.
- You need a policy setting standard retention periods wherever possible, to comply with documentation requirements.
- You should also periodically review the data you hold, and erase or anonymise it when you no longer need it.
- You must carefully consider any challenges to your retention of data. Individuals have a right to erasure if you no longer need the data.
- You can keep personal data for longer if you are only keeping it for public interest archiving, scientific or historical research, or statistical purposes.
Eight weeks is long enough for anyone to reconcile their journey and payment history and highlight any discrepancy. Longer than that is difficult to justify for that purpose. However, detection of fare evasion (which is a separate purpose) is a justifiable public good.
Last edited: