Storage Limitation (Article 5(1)(e) GDPR)

Article 5(1)(e) GDPR requires that personal data be kept in a form which permits identification of data subjects only for as long as is necessary for the purposes for which they are processed. The principle is an expression of the principle of proportionality and gives concrete shape to data minimization in temporal terms.

1 Overview

1.1 Legal consequence and the burden of justification

The fact that the Union legislature has cast the temporal dimension as a self-standing principle gives that dimension particular weight and increases the burden of justification borne by the controller. Recital 39, eighth sentence, GDPR expressly requires that the storage period be limited to a "strict minimum".

1.2 Internal determination of the storage period

Under Article 13(2)(a) and Article 14(2)(a) GDPR, the controller must inform the data subject of the period for which the personal data will be stored or, where a specific period cannot be stated, of the criteria used to determine that period. It follows from the link with the accountability principle (Article 5(2) GDPR) that the storage period, or the criteria relied on to determine it, must be established internally, in much the same way as the purpose of the processing. That determination also serves to demonstrate compliance vis-à-vis the supervisory authority.

2 Content of the principle

2.1 Necessity in temporal terms

Article 5(1)(e), first half-sentence, GDPR covers two situations:

• Achievement of the purpose: once the purpose of the processing has been fulfilled, the basis for storage falls away. The data must be erased.
• Loss of relevance to the purpose: data may lose their relevance to the purpose even before that purpose has been achieved, for instance because they are no longer up to date or have been superseded by more recent information (CJEU, judgment of 13 May 2014, C-131/12, Google Spain, paras. 93 et seq.).

2.2 Proactive duty to erase

The controller must erase the data on its own initiative; it may not wait until the data subject asserts the right to erasure under Article 17(1) GDPR (CJEU, judgment of 13 May 2014, C-131/12, Google Spain, para. 72; CJEU, judgment of 16 December 2008, C-524/06, Huber, para. 60).

2.3 Regular review

In order to give practical effect to the duty to erase, the controller must review its data holdings at regular intervals (Recital 39, tenth sentence, GDPR). The review intervals must be documented in the records of processing activities pursuant to Article 30(1), second sentence, point (f), GDPR.

2.4 Precautionary storage is impermissible

Where data are no longer necessary for the purpose of the processing, they may not be kept in reserve for unspecified future purposes. The prohibition of precautionary storage follows directly from the interplay between purpose limitation and storage limitation.

3 Privileged purposes

3.1 Archiving purposes, research, statistics

Article 5(1)(e), second half-sentence, GDPR contains an exception in favor of processing for archiving purposes in the public interest, for scientific or historical research purposes, or for statistical purposes. In doing so, the Union legislature takes account of society's interest in functioning research and in the preservation of the collective memory.

3.2 Accompanying safeguards under Article 89 GDPR

Longer storage is permissible only where the technical and organizational measures required by Article 89(1) GDPR are complied with. Under Article 89(1), third sentence, GDPR, the controller must examine whether the purpose can also be achieved with anonymized data. Only where that is not possible may data be processed in identifiable form.

4 Relationship to the other principles

Storage limitation interlocks with purpose limitation: without a specified purpose, no storage period can be determined. It is also dovetailed with accountability, because the controller must be able to demonstrate compliance with erasure periods, and with integrity and confidentiality, because erasure itself constitutes a technical and organizational measure.