According to Article 5(1)(e) of the GDPR, personal data should be “kept in a form which permits identification of data subjects for no longer than is necessary” (see “Storage limitation principle” subsection in the “Principles” section of the General Part of these Guidelines). However, the GDPR permits storage for longer periods if the sole purpose is scientific research (or archiving in the public interest, historical research or statistical purposes), provided that controllers are allowed to proceed to such processing under an adequate legal basis (storage involves data processing). “The intention of the lawmaker appears to have been to dissuade unlimited storage even in this special regime, and guards against scientific research as a pretext for longer storage for other, private, purposes. If in doubt, the controller should consider whether a new legal basis is appropriate.”[1]
Therefore, storage periods should be proportionate to the aims of the processing. “In order to define storage periods (timelines), criteria such as the length and the purpose of the research should be taken into account. It has to be noted that national provisions may stipulate rules concerning the storage period as well.”[2]
References
1EDPB, Guidelines 03/2020 on the processing of data concerning health for the purpose of scientific research in the context of the COVID-19 outbreak. Adopted on 21 April 2020, p. 10. At https://edps.europa.eu/sites/edp/files/publication/20-01-06_opinion_research_en.pdf Accessed: 23 April 2020. ↑
2Ibidem, p. 10. ↑