white_paper_on_data_protection_in_india_171127_final_v2

CHAPTER 7: STORAGE LIMITATION AND DATA QUALITY
7.1 Introduction
(i)
Storage Limitation
As discussed in Part III, Chapter 5 of the White Paper, the principle of purpose specification
requires that the purpose for which data is being collected must be specified at the time of
collection, and subsequent use of such data must ordinarily be limited to such purpose(s).
Adherence to this principle is necessary to ensure that the processing of data is lawful. A
closely connected principle is that of storage limitation. This principle requires that data must
be retained by an organisation only for the time period that is reasonably necessary to fulfill
the purpose for which it was collected. Thus, when data no longer serves a purpose, it may be
necessary, if practicable, to have it erased or anonymised. 532
(ii)
Data Quality
The related principle of data quality is an obligation on data controllers to create, maintain,
use or disseminate personal data in such a manner as to ensure the reliability of such data for
its intended use. 533 The OECD Guidelines stipulates that ―Personal data should be relevant to
the purposes for which they are to be used, and, to the extent necessary for those purposes,
should be accurate, complete and kept up-to-date.‖ 534 Such an obligation exists since
processing of incorrect or inaccurate data can have detrimental consequences for the
concerned individual, such as denial of services like loans, credit etc. Data quality is also
closely linked with individual participation rights (discussed in Part III, Chapters 8, 9 and 10
of the White Paper) since an individual can, by accessing one‘s data, require the organisation
to correct it in case it is inaccurate.
7.2 Issues
(i)
Implementation
The principle of storage limitation requires an organisation to store personal data only for a
time period that is ―reasonably necessary‖ for the purpose for which it was collected. The use
of a subjective term such as ―reasonably necessary‖ may affect implementation since it will
be difficult to impose a tangible obligation on the organisation. For instance, an organisation
532 OECD, ‗OECD Guidelines on the Protection of Privacy and Transborder Flows of Personal Data‘ (2013),
available
at:
http://www.oecd.org/sti/ieconomy/oecdguidelinesontheprotectionofprivacyandtransborderflowsofpersonaldata.ht
m (last accessed 31 October 2017).
533
CIPP Guide, ‗The HEW Report: Defining the Fair Information Practices‘, available at:
https://www.cippguide.org/2012/08/23/the-hew-report-defining-the-fair-information-practices/, (last accessed 26
October 2017).
534 OECD, ‗OECD Guidelines on the Protection of Privacy and Transborder Flows of Personal Data‘ (2013),
available
at:
http://www.oecd.org/sti/ieconomy/oecdguidelinesontheprotectionofprivacyandtransborderflowsofpersonaldata.ht
m (last accessed 31 October 2017).
117