In this Privacy Tracker post, Kaira Wells offers an overview of provisions around data retention in Canada's Personal Information Protection and Electronic Documents Act and the EU General Data Protection Regulation, noting, "It may be reasonable to construe GDPR data retention through the lens of Canadian law." Including insight from decisions of the Canadian Office of the Privacy Commissioner, Wells notes, "When evaluating retention under the GDPR, the question of purpose must be answered. ... Despite the lack of clarity or guidance in the GDPR, Canadian cases evaluating retention practices under PIPEDA Principle 5 may be helpful to those trying to make sense of the retention language of the GDPR."
Full Story