GDPR and data retention
Discussion
I am being told stuff by somebody professing to be a GDPR expert and I think it's not based in fact.
We have an electronic expenses system. People complete an online expense claim form, upload their receipts, it goes to their line manager for approval, and then comes through to Finance for payment.
We retain all finance records for 6 complete financial years. We then get it shredded or deleted. However the problem with electronic expenses is that, as long as the person is still an employee, their claims history is still "live" and the system will have a record of ALL their expense claims, ever since they started.
Mr GDPR expert is saying that we need to delete any expense claims that are over 6 years as its not GDPR compliant.
Surely this isn't true? I have no desire to ask one of my team to go through 1000 staff records and manually delete expense claims which are over 6 years old.
Would any GDPR people be able to advise?
We have an electronic expenses system. People complete an online expense claim form, upload their receipts, it goes to their line manager for approval, and then comes through to Finance for payment.
We retain all finance records for 6 complete financial years. We then get it shredded or deleted. However the problem with electronic expenses is that, as long as the person is still an employee, their claims history is still "live" and the system will have a record of ALL their expense claims, ever since they started.
Mr GDPR expert is saying that we need to delete any expense claims that are over 6 years as its not GDPR compliant.
Surely this isn't true? I have no desire to ask one of my team to go through 1000 staff records and manually delete expense claims which are over 6 years old.
Would any GDPR people be able to advise?
What is your justification for keeping that data? Is it just because the system isn't designed to remove it? Under GDPR you have privacy by design/default requirement meaning retention periods must be automated if designing/implementing new systems. However, it does not apply retrospectively.
That said, you still need to inform people how you are storing their data, why and for how long, which comes back to your legal justification.
Strictly speaking, best practice would be to remove the old data - cleansing is a big part of GDPR compliance but the ICO realises it can't reasonably force employers to amend existing systems.
Just to add, I'm not a GDPR expect but heavily involved in compliance with it.
That said, you still need to inform people how you are storing their data, why and for how long, which comes back to your legal justification.
Strictly speaking, best practice would be to remove the old data - cleansing is a big part of GDPR compliance but the ICO realises it can't reasonably force employers to amend existing systems.
Just to add, I'm not a GDPR expect but heavily involved in compliance with it.
As part of your assessment for retaining this beyond the 6 years, you need to be able to justify it. Is it hard to delete it all, a bit difficult or impossible?
An important thing to remember is that any personal data you hold brings a burden to protect it. If you can justify the retention, you should document that justification and make sure it's held securely.
If there were to be a data breach, the regulator would ask why you had old records you no longer needed. Under GDPR, you can't make that answer up when there's a breach, you'd need to have a record available to show you'd considered it in advance.
Consider who has access to the data, the more people with access the greater the risk.
Also bear in mind that if someone makes a data subject access request or a request to delete the personal data you hold about them, you're obliged to make reasonable efforts to do this which might mean trawling through the data anyway. As I say, it's a burden to hold it so often best to get rid of whatever you can as soon as you can.
An important thing to remember is that any personal data you hold brings a burden to protect it. If you can justify the retention, you should document that justification and make sure it's held securely.
If there were to be a data breach, the regulator would ask why you had old records you no longer needed. Under GDPR, you can't make that answer up when there's a breach, you'd need to have a record available to show you'd considered it in advance.
Consider who has access to the data, the more people with access the greater the risk.
Also bear in mind that if someone makes a data subject access request or a request to delete the personal data you hold about them, you're obliged to make reasonable efforts to do this which might mean trawling through the data anyway. As I say, it's a burden to hold it so often best to get rid of whatever you can as soon as you can.
Freakuk said:
My take on this is that whatever your data retention policy is, whether that be electronic or otherwise. GDPR is more the controls around the data - owner, processor.
Your data retention policy is meaningless unless you can justify it, and when planning any new system that is key (as per my earlier comment).Otherwise we could just say, well, our data retention policy is keep everything, forever, just in case.
I think you could just about justify holding on to data for the length of someone's employment, in case of a query or disciplinary procedure.
However, you'd have a much harder case for employees who have left. When I implemented GDPR we deleted all data from employees who have left more then seven years ago - in line with HMRC's guidelines.
However, you'd have a much harder case for employees who have left. When I implemented GDPR we deleted all data from employees who have left more then seven years ago - in line with HMRC's guidelines.
Gassing Station | Business | Top of Page | What's New | My Stuff