In the bulletin of May 9, 2024, we recalled that retention is a processing operation and that personal data should be retained for a limited time, indeed, for the minimum amount of time necessary to fulfill the stated purpose.
In this round, we focus on the legal value of determining retention periods.
Retention periods and personality protection
Personal data are an integral element of the “person”; they characterize the individual in his or her singularity, i.e., enucleating him or her from the collectivity through the evidence of distinctive traits.
The legal system protects this status, in the dimension known as individual personality. The protection of the personalityaims to ensure its free development (Art. 2, Italian Constitution) also through the legal recognition of a safeguard of confidentiality of both the individual dimension (personality, personal data protection, Art. 8, Charter) and context (protection of private life, Art. 7, Charter).
The use of personal data by third parties causes an interference to the confidential dimension of the individual context such that it requires specific regulation: the data protection framework.
Effectiveness of use
To meet the obvious needs of the “information society” by ensuring the legitimate sharing of information, the legislator justifies the use of personal data by third parties on the condition that these data satisfy an actual utility, rather than a hypothetical or theoretical need. Accordingly, the use of personal data is permissible when it is strictly functional (i.e., it is necessary) in the pursuit of a lawful purpose.
The requirement of effectiveness of use is expressed in terms of:
- Functionality, in the sense that use is justified if it is “necessary” for the pursuit of the specific lawful and stated purpose; as evidenced by each of the five legal bases in Article 6 of the GDPR, in addition to the consent of the data subject (principle of necessity and specific purpose)
- Proportionality, because only the use of those data that are necessary for the achievement of the purpose, without excess, finds legal justification (principle of data minimization)
- Temporality, because personal data may be used by third parties only for the minimum time frame necessary to fulfill the purpose pursued (storage limitation).
Accordingly, the limitation of the retention of personal data is a principle directly functional to the protection of personality, as limited retention circumscribes the impact that the use of personal data by third parties causes to the fundamental rights and freedoms of the data subjects.
Violation of this principle-represented by the failure to specify retention periods or the criteria for determining them, or resulting from the non-proportionality of such terms-constitutes an injury to individual personality.
