Re: Indefensible
"You're not quoting any legal definition here, then"
Exactly that is my point there is no test of reasonableness that need defining in law. As an organisation you need to make a valid assessment balancing the rights of individuals against legal requirements and essential needs. If you make that assessment that you are holding it for the minimum amount of time necessary and have informed the users then you are compliant, it doesn't need a court to decide this.
If you are holding data for longer just for your own marketing uses then it is not legal. My opinion 6 months would be fine for a customer account, they are free with greater insight to choose a longer period. If their marketing team get involved and ask to hold it for longer than defined purely by legislative or essential need then it is probably illegal.
This is the reason why the threshold for a DPO is quite low and they must be completely independent of any department that has a vested interest in the data and must be at a level that can report directly to the board or equivalent.
Biting the hand that feeds IT
