Universal Consent & Preference Management Data Retention Best Practices

Today, businesses are dealing with unprecedented amounts of digital information with around 2.5 quintillion bytes of data being created each day, according to a report by G2 in early 2023. As reported by MIT SERC in early 2022, the Cloud now has a greater carbon footprint than the airline industry with the electricity utilized by data centers accounting for 0.3 percent of overall carbon emissions.

It is important to limit the exponential growth in data by developing and implementing data retention and destruction policies. Implementing data retention and destruction policies for data no longer needed helps your organization:

  • Maintain global compliance with data storage rules across regulations;

  • Reduce the costs associated with storing all data indefinitely;

  • Reduce the carbon footprint linked with data storage;

  • Improve the overall performance of the OneTrust application.

Overview

Most privacy legislation does not set specific time limits for the period of retention for different types of data. The period of retention will be determined by what would be appropriate, necessary, and justifiable. In certain instances, other non-data privacy legislation will set thresholds that can be used as guidance, such as for the healthcare and financial sectors. For more information, see Healthcare Sector and Financial Sector.

Legislative Guidance - General

For additional insight, the excerpts below were taken from various laws and regulations regarding the retention of personal data in general. These excerpts are intended to provide a broad overview of the legislative approach to data retention.

Note:

Please consult your location's requirements and legal obligations when developing your own data retention schedules.

OneTrust DataGuidance® Retention Schedules can be referenced for country-specific retention periods for different categories of data. For more information on accessing this feature, see Introduction to Retention Schedules.

Location

Law/Regulation

Legal Requirements

European Union

General Data Protection Regulation (GDPR)

  • Article 5, co.2(e):

    • Personal data may be stored for longer periods insofar as the personal data will be processed solely for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes in accordance with Article 89(1) subject to implementation of the appropriate technical and organisational measures required by this Regulation in order to safeguard the rights and freedoms of the data subject (‘storage limitation’).

  • Recital 39: Principles of Data Processing

    • In order to ensure that the personal data are not kept longer than necessary, time limits should be established by the controller for erasure or for a periodic review.

United Kingdom

Information Commissioner's Office (ICO)

  • You must not keep personal data for longer than you need it.

  • You need to think about – and be able to justify – how long you keep personal data. This will depend on your purposes for holding the data.

  • You should also periodically review the data you hold, and erase or anonymise it when you no longer need it.

United States

California Privacy Rights Act (CPRA)

  • You cannot keep personal data forever and if you need to, you need to have a valid reason for same. Data subjects are to be made aware of the reason.

New York SHIELD (Stop Hacks and Improve Electronic Data Security) Act

  • Businesses must dispose of private information within a reasonable amount of time after it is no longer needed for business purposes by erasing electronic media so that the information cannot be read or reconstructed.

Canada

Personal Information Protection and Electronic Documents Act (PIPEDA)

  • Principle 5:

    • Personal information that is no longer required to fulfil the identified purposes should be destroyed, erased or made anonymous.

Healthcare Sector

For the Healthcare sector in the United States, the recommended best practice would be to consider all circumstances related to processing (e.g. when the purpose for which it is collected is reached) while taking into account legal obligations (e.g. Statutes of limitations for claims). For country-specific requirements related to the health sector, see DataGuidance® Health and Pharma Overview Insight series.

Note:

Please review the legislative guidance below and consult your location's requirements and legal obligations when developing your own data retention schedules.

Legislative Guidance - Healthcare

  • With regards to HIPAA data (Personal Health information (PHI) e.g. medical records), retention periods are set by each states’ requirements.

  • For HIPAA records which are HIPAA covered entities internal documentation related to HIPAA compliance (e.g. risk assessments, policies, security reviews, PHI access requests), the retention period is six years but it may be longer because of other legal obligations.

  • For all other personal information that HIPAA covered entities collect and process e.g. PI collected when someone visits HIPAA website and PI is then used for marketing purposes, retention periods should be set pursuant to each state's PI retention requirements.

Financial Sector

For the Financial sector, the recommended best practice will vary depending on the location in which your organization operates.

Note:

Please review the legislative guidance below and consult your location's requirements and legal obligations when developing your own data retention schedules.

Legislative Guidance - Financial

For additional insight, the excerpts below were taken from various laws and regulations regarding the retention of personal data in the financial sector. For country-specific requirements related to the financial sector, see DataGuidance® Data Protection in the Financial Sector Insight series.

Location

Law/Regulation

& Legal Requirements

United States

Gramm-Leach-Bliley Act (GLBA)

  • Section 314.4(c)(6)

    • A company within the scope of GLBA is obliged to develop, implement, and maintain procedures for the secure disposal of customer information in any format no later than two years after the last date the information is used in connection with the provision of a product or service to the customer to which it relates, unless such information: (1) is necessary for business operations or for other legitimate business purposes; (2) is otherwise required to be retained by law or regulation, or; (3) where targeted disposal is not reasonably feasible due to the manner in which the information is maintained.

Fair Credit Reporting Act (FCRA)

  • The FCRA does not impose a specific record retention requirement. However, the statute of limitations for consumer allegations relating to FCRA violations is the earlier of two years after the consumer discovers the violation or five years after the date of the violation (15 U.S.C. § 1681p).

Regulation B of the Equal Credit Opportunity Act of 1974

  • Related laws and regulations, such as Regulation B of the Equal Credit Opportunity Act of 1974, require records retention of a period of 25 months for consumers, or 12 months for business, for actions taken on applications or accounts (12 C.F.R. § 1002.12).

Code of Federal Regulations

  • Reports and records created to comply with the BSA must be retained for a period of five years (37 C.F.R. § 1040.400 et seq).

United Kingdom

Anti-Money Laundering / Countering the Financing of Terrorism (AML/CFT)

  • Firms need to keep records of all customer due diligence measures carried out for five years from the date a business relationship ends or five years from the date a transaction took place.

Belgium

Anti-Money Laundering / Countering the Financing of Terrorism (AML/CFT)

  • Obliged entities shall retain all transactional and identification data for 10 years from the end of the business relationship or 10 years from the transaction carried out where it is done on an occasional basis (Article 60 of Act of 18 September 2017).

Financial Services and Markets Authority

  • An insurance broker must be able to justify the reason why it will retain customer data beyond five or seven years (if the FSMA so requests) following termination of the contract.

Spain

Organic Law 3/2018 on the Protection of Personal Data and Guarantee of Digital Rights (LOPDGDD)

  • Article 20

    • In relation to credit information systems, data may be retained as long as payment defaults persist, with a maximum limit of five years from the due date of the monetary, financial, or credit obligation.

Financial System Reforms Law

  • Article 64

    • With respect to the data entered in the Risk Information Centre ('CIR'), such data shall be kept for ten years commencing from the date on which the report was made.

PSD2 Decree-Law

  • Article 24

    • Payment entities must keep all documents for at least six years.

Anti-Money Laundering / Countering the Financing of Terrorism (AML/CFT)

  • Article 25

    • Obliged entities are required to keep AML related records for a minimum of 10 years.

Potential Risks and Examples of Legal Enforcement

Keeping data for longer than is necessary may come with the following risks:

  • More data to ensure you keep secure;

  • E-discovery risk;

  • Increased storage costs;

  • Deleting/using data in error;

  • More data to review and redact when actioning Data Subject Access Requests;

  • Inaccurate and out of date data;

  • Burden to respond to deletion requests;

  • Non – compliance risks.

The over retention of personal data has been enforced by Data Protection Authorities (“DPA”) both in the EU and the US. The following are examples of actions taken to enforce laws and regulations regarding the retention of personal data:

  • In November 2022, the French DPA (CNIL) fined Discord Inc. 800,000 euros because the company failed to define a data retention period. A large number of user accounts in their database had not been used for more than three years and other user accounts had not been used for more than five years.

  • The Federal Trade Commission (FTC) issued a fine against CafePress for, among other practices, storing personal information indefinitely on its network without any specific business needs.

  • The New York AG in January 2022 announced a settlement with a vision-benefits-provider related to a 2020 security incident. In the settlement agreement, the AG highlighted that the company's security measures were not compliant with the SHIELD Act with respect to four aspects: authentication, password management, logging and, in particular, data retention.

  • The FTC finalized an enforcement action in 2023 against Drizly LLC because the company's security failures led to a data breach exposing the personal information of about 2.5 million consumers. To rectify the situation, the FTC ordered some specific remedial actions, including, to establish “data retention limits” through the creation of a retention schedule for personal information, which the company must post publicly on its website.

Best Practices for Consent Data Retention

Overall, you should only keep data for as long as is necessary to give effect to the purpose for which the data was collected. The following are recommendations to consider when evaluating consent records:

  • How long consent lasts will depend on the context, the scope of the original consent, and the expectations of the data subject. If the processing operations change or evolve considerably then the original consent is no longer valid. If this is the case, then new consent needs to be obtained.

    Note:

    For example, say a theater gives patrons the opportunity to opt in to receiving emails about shows in the upcoming season that runs from October 2023 to April 2024. Since the consent request specifies the time period and end point, data subjects would expect these emails to stop once the season is over, which is when their consent will expire.

    If the theater wanted to give patrons the opportunity to opt in for shows in the following October 2024 to April 2025 season, new consent would need to be obtained.

  • Consent should be refreshed at appropriate intervals. Providing all the information again helps to ensure the data subject remains well informed about how their data is being used and how to exercise their rights. If the individual re-consents, then the retention ‘clock’ can be re-set.

  • If the personal data relates to prospective customers and came from a third party, then there are two scenarios:

    • If the contact took place, you should keep the data for a reasonable period of time after the contact to support any further requests from the individual.

    • If no contact took place, you should delete the data promptly after the permission to contact expires.

  • Evidence of opt-out needs to be kept for as long as possible. This is to ensure that data subjects who have opted out are not contacted in future unless they specifically opt in again. The information retained should be kept to the bare minimum and full details in the consent receipt should be deleted/destroyed after the recommended periods.

Defining Your Data Retention Schedule

You can mitigate the risk of keeping consent data for longer than is necessary by implementing a data retention policy to help you manage data more effectively and delete data that is no longer needed. Targeted and automatic data purging after the defined retention periods expire can help limit your liability, create additional storage, and reduce human error. Data retention policies can be set up within the OneTrust application to:

  1. Specify the types of data that will be stored and how long it needs to be retained for regulatory, legal, and organizational purposes;

  2. Define disposal schedules based on relevant government and industry regulations.

Note:

For more information, see Setting Up Consent Retention Policies.

Questions for Consideration

There are a number of factors to take into account in the decision-making process for retention periods. Decisions are likely to be more complex where personal data is processed for multiple purposes. For example, the data may no longer be necessary for one purpose but may remain necessary for another purpose.

When evaluating the consent data that you have stored, you can consider the following questions:

  1. What was the original purpose for storing the data?

    1. Is the original purpose still valid?

  2. Is the data driving the business in any way?

    1. Is the data actively used in marketing activities?

    2. Is there regular interaction with the customer?