Beyond the definition of data minimization given in Art. 5(1)(c), the second part of Art. 5(1)(e) “storage limitation” GDPR states explicitly states that:
| [P]ersonal data may be stored for longer periods insofar as the personal data will be processed solely for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes in accordance with Article 89(1) subject to implementation of the appropriate technical and organizational measures required by this Regulation in order to safeguard the rights and freedoms of the data subject; |
This refers to the further processing for compatible purposes after fulfilling the initial purposes described in Art. 5(1)(b) GDPR[1].
Since it is concerned with storage of personal data, it is considered here to be pertinent to data minimization since the statement “limited to what is necessary in relation to the purposes” is not restricted to only data volume but clearly must also be understood to address the temporal aspect of data. Also, data minimization concerns all aspects of processing (such as collection and disclosure) and therefore also addresses storage.
For these reasons, the second part of Art. 5(1)(e) GDPR is considered here to provide guidance on how to interpret the principle of data minimization in the context of further processing for compatible purposes after fulfilling the initial purposes.
Beyond this, the GDPR emphasizes the importance of the principle in various contexts:
In Art. 25(1) GDPR on Data Protection by Design, It emphasizes how data minimization shall be considered in every phase of the life cycle of a processing activity. This includes for example the analysis and conception phase of a processing activity where the purposes of processing are determined: Evidently, the more precise and narrow the purposes are specified, the clearer it becomes which data are actually necessary and the more data can be recognized as unnecessary. Similarly in a later life cycle phase, measures can be taken to implement effective deletion or reduction of information content.
Art. 89(1) and Recital 156 GDPR emphasize the importance of data minimization for the case where after fulfilling the initial purposes, data is processed further for “compatible purposes”[2]. In particular, “archiving purposes in the public interest, scientific or historical research purposes or statistical purposes shall, in accordance with Article 89(1), not be considered to be incompatible with the initial purposes”[3]. Art. 89(1) GDPR (2nd sentence) explicitly mandates that for this further processing, “technical and organizational measures are in place in particular in order to ensure respect for the principle of data minimization”.
References
1Namely, Art. 5(1)(b) contains the following statement: “further processing for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes shall, in accordance with Article 89(1), not be considered to be incompatible with the initial purposes”. ↑
2See Art. 5(1)(b) GDPR. ↑
3Wording taken from Art. 5(1)(b) GDPR. ↑