At the end of July 2018, the Austrian Data Protection Authority (DPA) published its first decision on retention periods following the enactment of the General Data Protection Regulation (GDPR).(1) The decision is final.
The DPA had to decide how long a telecoms service provider (hereafter, the controller) must retain so-called 'master data' – that is, data required for the controller's legal relationship with the user of its services (hereafter, the applicant).
In the case at hand, the controller retained the applicant's master data for 10 years. The controller claimed that it was lawful to retain such data based on Section 207(2) of the Federal Fiscal Code.
The second sentence of Section 207(2) contains a limitation period. In cases of tax evasion, the tax authority may determine how much tax will be levied within a 10-year period starting from the calendar year in which the offence occurred.
According to the DPA, retaining data under the limitation period set out in Section 207(2) does not comply with the GDPR, as limitation periods do not include a legal obligation to retain records. Whereas, retaining master data for seven years is lawful, because Section 132 of the code obliges the controller to retain certain books and records for seven years.
In this case, the DPA's decision was driven by a specific telecoms provision – namely, Section 97(2) of the Telecommunications Act 2003. This provision explicitly allows data storage only for certain purposes (eg, compliance with a legal obligation). On that basis, the DPA refused to accept that a provision concerning limitation periods (eg, Section 207(2)) constituted a legal obligation.
That said, the regulator is clearly hesitant to accept limitation periods to allow for data storage in all cases. It remains to be seen how this case law will evolve insofar as limitation periods are concerned.
For further information on this topic please contact Günther Leissler or János Böszörményi at Schoenherr Attorneys at Law? by telephone (+43 1 5343 70) or email ([email protected] or [email protected]). The Schoenherr Attorneys at Law website can be accessed at www.schoenherr.eu.
This article was first published by the International Law Office, a premium online legal update service for major companies and law firms worldwide. Register for a free subscription.
Endnotes
