What to do if the data are collected for an indefinite period of time?


Case description: a company or a state institution offers to subscribe for news and the person indicates their data. The Regulation states that, when collecting data, you must indicate a period and purpose for storing data. In this case, the purpose is to inform about news during the existence of the company or until the person unsubscribes from receiving news.

The basis for processing personal data will most likely be the consent of the data subject when subscribing for news. However, that does not mean that a person’s consent will be a valid basis for processing personal data for an indefinite period of time; also, the purpose of using personal data processing to inform about news for an indefinite period time will not be reasonable. For example, the Information Commissioner’s Office in the United Kingdom points out that if for some reason it is difficult to determine the period of data processing for which consent is needed, then the consent should be renewed every two years, i.e. if the person does not renew their consent for receiving news, the mailing must be stopped even if the company/organisation is still running and the person has not unsubscribed.