GDPR: Retention and deletion of personal data

Čo v článku nájdete:

• Retention period and deletion
• Employees—personnel files and other personal data
• Practice and recommendations

Businesses have difficulty setting retention periods and complying with the deletion of personal data. This is caused by legislation that is not always clear, as well as the sudden burden placed on businesses that do not address personal-data protection continuously.

This article explains retention and deletion of personal data in general and in relation to employees’ personal data.

Retention period and deletion

Setting a retention period raises many questions. The storage-limitation principle requires the controller to process and retain personal data only for as long as necessary.

The period may be specified by law or determined by the controller. It should not be disproportionally long.

There are cases where the retention period is:

• specified or recommended by law,
• specified or recommended by practice, public authorities or other guidance and recommendations,
• set by the controller itself.

For statutory rules, we often identify an exact retention period (for example under accounting and income-tax legislation). Problems may arise where the retention period for personal data is not set (for example, camera-system records) or is set by the controller (for example, retention of unsuccessful applicants’ CVs).

The retention period must be properly justified for every processing purpose (or category of purposes) and for the relevant categories of personal data.

Once the retention period expires, the personal data must be deleted. It is important to set up a system for deletion. Deletion is easy to “monitor” in an electronic email or e-shop database. It is more difficult for paper records—personnel files, accounting documents and other documents held by businesses are normally in paper form.

Employees—personnel files and other personal data

The scope of employee-data processing is extensive. From selecting and hiring an employee through maintaining a personnel file until the employee reaches 70, the employer processes employees’ personal data.

However, not all data and information placed in a personnel file should be part of it. Personnel files often contain copies of identity documents and other personal data and documents that are not necessary for maintaining the file.

The documents and personal data in a personnel file must be distinguished when setting retention periods. Some must be retained until the employee reaches 70 to demonstrate the employee’s entitlement to an old-age pension and determine its amount.

If personnel files are to be retained until age 70, we recommend “selecting” the documents necessary specifically for pension calculations. Other documents should have a shorter specified retention period and deletion period.

The content of a personnel file is not fixed, but even here the purposes of processing and the retention period must be set and justified. The deletion system should also be configured to be automated as far as possible.

Practice and recommendations

In practice, retaining personal data is often problematic, both when setting the retention period and when carrying out deletion after it expires. In complying with GDPR, we recommend that businesses pay attention to setting up a personal-data retention system and automating deletion.