Deleting data has never been more important

Within the past year, the Danish Data Protection Authority has paid particular attention to companies' deletion habits. Although companies established in Denmark yet remain to receive fines after the GDPR, the Danish Data Protection Authority has reported both the Danish taxi company Taxa 4x35, and the Danish design and furniture chain IDdesign A/S to the police. Fines of DKK 1,2 million and DKK 1,5 million for not deleting personal data pursuant to the GDPR have been suggested to be appropriate.

Taxa 4x35 failed to deleted personal data of 9 million customers. According to the Danish Data Protection Authority, such personal data was stored without being necessary for the purpose of what it was collected for. Taxa 4x35 did deleted the customer's name after 2 years, however, the customers phone number and start- and end coordinates were stored for another 3 years. The company claimed, that it was using it's customers' personal data to develop its product- and business. Keeping such information for 5 years, simply because keeping it on file made it easier for Taxa 4x35's system to enhance the company's product- and business development, was however not proven to be necessary.

IDdesign A/S failed to deleted personal data of 385.000 customers which was stored in an old company system. While auditing IDdesign, the Danish Data Protection Authority paid special attention to whether IDdesign had a policy on retention and the compliance hereof. Because IDdesign had not considered for how long data was stored in this old system, it was never deleted.

What is particullarly interesting is thus, that IDdesign was not only criticized for not deleting personal data from the old system, but in particular for not having a retention policy in place which documented that IDdesign had taken a position on whether data had to be deleted or not.

Based on the criticism of IDdesign A/S, it is important to consider whether one's company has all the formal requirements in place. Especially because deleting data is not only a prerequisite to comply with the GDPR it may also become extremely expensive if you don't ensure that your company only retains personal data which is necessary. Hence, we recommend that you check your deletion routine and have policies in place – especially in regard to "older" data.