Why does data retention matter?

The golden rule for data retention for commercial purposes under Italian law comes from the Italian Data Protection Authority’s (Garante) Guidelines applying to loyalty and fidelity programs of February 24, 2005 (Guidelines), which is still applicable under the GDPR and the reformed Italian Data Protection Code.

These Guidelines introduced a strict period for retention of personal data processed for marketing and profiling purposes in connection with loyalty initiatives (i.e., respectively 24 and 12 months). This periods soon became a market standard for companies processing data for commercial purposes, with the sole exception of those operating in the luxury fashion industry.

This is because such companies claimed they needed longer retention periods in order to better exploit the potential of the data they collected for performing client engagement activities. In fact, the luxury fashion industry has a low purchase frequency compared to other sectors and, therefore, longer retention periods are necessary in order to extract value from data for marketing and profiling purposes.

Consequently, since the Guidelines came into effect many luxury fashion companies started requesting the Garante for a derogation from the 12 and 24 months retention periods set forth in its guidance. Requests of this kind grew more frequent over time and came from many different luxury brands; however, with GDPR’s accountability principle (i.e., setting forth the possibility for data controllers to decide independently their own retention periods in compliance with applicable data protection laws) this would most likely change in the future.

In fact, the GDPR does not provide specific instructions with regard to data retention and leaves controllers free to decide their retention periods through a risk-based approach. This can certainly benefit the luxury fashion industry, especially in an age when digital marketing and profiling activities are crucial; however, there are also some concerns from a data privacy perspective.

Top legal issues about data retention

1. Storage limitation and data security: How can companies actually justify the need to store personal data for a very long time while remaining in compliance with the GDPR? A prior internal assessment on the actual need to retain data for long periods is necessary, because storing data for such long periods also means exposing a company’s database to possible threats such as back-up failures, data breaches etc.
2. GDPR v local requirements: Although GDPR sets the main legal framework at a European level, guidance from national DPAs could add specific provisions concerning data retention (especially for marketing and profiling). For instance, that is the case of the Guidelines, whose consistency with GDPR’s principle of accountability is still subject to debate under Italian law. In fact, the definition of precise retention periods such as those provided by the Guidelines limits the scope of the data controller’s accountability under the GDPR.
3. “Sanity check” of commercial databases: Checking the “age” of personal data contained in commercial databases is another essential part of privacy compliance that companies storing data for long periods must take into account. This is because the passing of time could make more complicated the assessment of the necessity of processing data for longer than certain retention periods in the eyes of regulators.
4. International transfers: Personal data moves around the world even if the only processing activity to which it is subject is storage. This means that companies must be able to represent in a transparent way to data subjects (i.e., by means of information notices or other documents) that their personal information could be moved across the globe, including outside the European Economic Area, for its entire lifecycle – until of course cancellation or anonymization occurs. In that regard, further contractual guarantees concerning service providers’ storage activities should be negotiated.
5. Extra-EU regulations: The GDPR is not the only data privacy law in the world. For instance, other similar pieces of legislation in the US, China or elsewhere could provide for specific retention periods applicable to marketing and profiling and, consequently, also to the processing activities of companies operating in the luxury and fashion industry. Attention to the global data retention legal framework is therefore essential for comprehensive privacy compliance.

Upcoming regulatory trends

Back in 2005, the Guidelines set out the main legal framework for data retention under Italian law with specific regard to processing activities for commercial purposes in the retail sector. As noted, this legal framework left margins for derogation to players operating in the fashion luxury industry, subject to Garante’s authorizations. Such derogations do not actually conflict with the GDPR, however, the Guidelines have now become obsolete in light of the new principle of accountability and the rapid evolution of marketing and profiling technologies. 

This is why the next board of the Garante (which the Italian Parliament is currently selecting) will most likely update the Guidelines in the coming months / years. As of today, there is no clear timeline for such a reform, nor there is an indication that the European Data Protection Board will intervene in the matter or the European Court of Justice will rule in that regard.

Do you have more questions or do you want to share your thoughts on this article? Contact our Dentons Italy TMT Team.