Latvia's data inspectorate: no single universal retention period for personal data

Ginta Gailuma, public relations specialist at Latvia's State Data Inspectorate (VDI), has commented on a cyber incident at the Road Traffic Safety Directorate (CSDD), in which unauthorized parties gained access to personal data that had been stored by the agency since 2008.

Addressing the incident, Gailuma explained that there is no single, universally applicable retention period for personal data. How long specific data may be kept depends on several factors, including the purpose of processing the data, the legal basis on which the processing rests, and other requirements set out in applicable regulations.

Background

CSDD was affected by a cyber incident that resulted in unauthorized access to personal data held by the agency, some of it dating back as far as 2008. This means data accumulated over more than fifteen years could potentially be affected.

The inspectorate's comment on retention periods came in response to questions about why a state institution held personal data spanning such a long period in the first place. The agency's representative stressed that determining how long the data should or could legally have been retained is not straightforward and must be assessed on a case-by-case basis, taking into account the original purpose for which the data was collected and the legal framework applicable to the specific institution and type of data.

As the supervisory authority for personal data protection, VDI continues to assess the situation related to the CSDD incident.