Are there ways of storing personal data beyond standard GDPR limitations?

Question

So GDPR harmonizes legal stance of personal data in the EU — mainly by limiting storage time of certain data, and by providing citizens with a procedure to request deletion of their personal data.

However, there seem to be some exceptions: I suppose financial and medical institutions store data beyond limits of regular entities (this would stand to reason at least). But what interests me is another case, as described by the following principle:

How long can we keep personal data for archiving, research or statistical purposes?

You can keep personal data indefinitely if you are holding it only for:

• archiving purposes in the public interest;
• scientific or historical research purposes; or
• statistical purposes.

Source: Principle (e): Storage limitation

Suppose there was a service for finding out one's geneaology tree, but the information they provide themselves would be used for future geneaology research. Would GDPR allow that, or the standard provisions would simply supersede such an arrangement and allow people to withdraw the information later on? Is there a way to store such information permanently in an explicit manner (i.e. by overtly stating “we will store your data indefinitely”)? In other words, would that qualify as permanent retetion for research under the cited principle?

Answer 1

The GDPR does not set fixed retention periods. Instead, it says data may not be kept for longer than necessary. What is necessary depends very much on the specific context of the processing activity, in particular on the purpose of processing.

The GDPR allows retention for as long as necessary.

For example, businesses (including financial institutions) are required to keep financial records. This requirement stems from EU member state law, which also sets specific retention periods. If a business wants to keep personal data in financial records for longer than this retention period, they can't just point to the law to authorize this processing – they must instead find a different purpose why they need to keep the data, and then find a suitable Art 6 legal basis.

In some cases, retention periods might not be coupled to a fixed duration, but to certain events. For example, personal data for online accounts should typically be kept until the account is closed, which is potentially indefinite. This follows directly from the GDPR approach of limiting data storage by necessity, not by duration.

All processing needs a clear purpose + a legal basis.

In the context of a genealogy site, the site should analyze carefully what data they collect for what purposes. These purposes might enable potentially unlimited retention. But such processing must also be covered by a legal basis, and I doubt that the site would have a legal basis to make such storage irrevocable.

• If the data is collected based on Art 6(1)(a) consent, then the data can only be used as consented to, and consent can always be withdrawn in the future.
• If the data is collected based on Art 6(1)(b) necessity for performance of a contract, then the data can be used for compatible purposes in the sense of Art 6(4), but that would require a new legal basis (e.g. legitimate interest).
• If the data is collected based on Art 6(1)(f) legitimate interest, then the data can be used for Art 6(4) compatible purposes but the data subject has the Art 21 right to object to processing.

While a genealogy site may have a legitimate interest in keeping supplied data in order to use it for future research, I think this is a fairly weak legitimate interest that can be easily overridden by an Art 21 objection, which in turn could require Art 17 erasure of the data. The genealogy site should also keep in mind principles like data minimisation and data protection by design and by default, so just keeping data for the off chance that it might be useful in the future is not GDPR-compliant. Data can only be collected and processed for “specified, explicit, and legitimate purposes”.

The Art 89 privilege for research purposes also imposes conditions.

There is a pretty big carveout in these GDPR requirements for archiving purposes in the public interest, scientific or historical research purposes, and statistical purposes. Specific rules for this exemption are given in Art 89 GDPR. The main value of this exemption is that Art 89 research purposes are always considered compatible with the purpose for which the data was originally collected (cf Art 5(1)(b)), though this might not cover data that was collected under the legal basis of consent (cf Art 6(4)). Other GDPR rules stay intact, and Art 89(1) imposes extra steps to consider:

• Special attention MUST be given to the data minimisation principle.
• If the research purpose can be achieved without identifiable data, the data MUST be anonymized.
• If the research purpose can be achieved with pseudonymized data, pseudonymization MUST be used.
• Appropriate safeguards MUST be implemented (though this just re-iterates the general requirement in Art 24).

In some cases, the research purpose stands in conflict with data subject rights like the right to be informed or the right to object. If so, EU or member state law can provide exemptions from the data subject rights, but can also impose further conditions or safeguards. It is not possible to rely on the Art 89 exception without taking member state law into account.

Art 89 does not modify necessity-based retention.

Now on to the main question: how long can the personal data be kept for research purposes?

While Art 89 research purposes allow us to extend the retention period because we have a new and compatible purpose of processing, it does not affect the general principle that data may only be kept as long as necessary for that purpose. In a scientific context, it would be common to preserve many data sets indefinitely for the purpose of enabling reproducibility of the scientific findings.

A privately-run genealogy service might not benefit from Art 89.

This “research” angle doesn't seem to be a good fit for a genealogy site. Such a site would typically not be collecting personal data for specific research purposes. At best, it would be operating as an archive of personal data which can be mined by future generations of researchers. But the GDPR specifically only considers archiving purposes in the public interest, which might not cover privately run archives. Archives rely on specific privileges in national laws, and severely restrict access to the information. For example, I'm leafing through the law on public archives in a German state. It forbids access for 10–100 years, depending on the date of death of the data subject and on the age of the documents.

This leads me to believe that a privately run genealogy site cannot reasonably rely on the Art 89 exemption, and must instead rely on an ordinary processing purpose + corresponding Art 6 legal basis. This doesn't directly prevent indefinite storage, but means that it will be easy for a data subject to invoke their right to erasure. It is not quite enough to say “we will keep the data indefinitely”, it is also necessary to have a clear purpose for this retention.

Answer 2

In addition to amon's excellent answer there is also the possibility of anoymizing that data.

If personal data can be truly anonymised then the anonymised data is not subject to the UK GDPR. It is important to understand what personal data is in order to understand if the data has been anonymised.

This quote is from the UK's writeup of the GDPR but since they are all just national implementations of a European law, there isn't much difference in the core ideas between each country. That link also more clearly defines what personal data is.

For most research purposes, anonymized data is more than enough, especially given that you wouldn't be allowed to contact anyone from the data pool for followup questions or the likes anyway.