Article
Personal Information Retention and Disposal: Principles ...
priv.gc.ca
Quoted on this wiki
Every place a page here uses this source, in the order the words come in it.
In assessing what is the appropriate retention period and whether it is time to dispose of personal information, an organization should consider the following points: “Reviewing the purpose for having collected the personal information in the first place is generally helpful in assessing how long certain personal information should be retained.” If personal information was used to make a decision about an individual, it should be retained for the legally required period of time thereafter – or other reasonable amount of time in the absence of legislative requirements – to allow the individual to access that information in order to understand, and possibly challenge, the basis for the decision.
Retention Periods “For some organizations, there is a legislative requirement to keep information for a certain amount of time.” In assessing what is the appropriate retention period and whether it is time to dispose of personal information, an organization should consider the following points:
Retention Periods “In other instances, there may be no legislative requirement, and an organization needs to determine the appropriate retention period.” In assessing what is the appropriate retention period and whether it is time to dispose of personal information, an organization should consider the following points:
Reviewing the purpose for having collected the personal information in the first place is generally helpful in assessing how long certain personal information should be retained. “If personal information was used to make a decision about an individual, it should be retained for the legally required period of time thereafter – or other reasonable amount of time in the absence of legislative requirements – to allow the individual to access that information in order to understand, and possibly challenge, the basis for the decision.” If retaining personal information any longer would result in a prejudice for the concerned individual, or increase the risk and exposure of potential data breaches, the organization should consider safely disposing of it.
If personal information was used to make a decision about an individual, it should be retained for the legally required period of time thereafter – or other reasonable amount of time in the absence of legislative requirements – to allow the individual to access that information in order to understand, and possibly challenge, the basis for the decision. “If retaining personal information any longer would result in a prejudice for the concerned individual, or increase the risk and exposure of potential data breaches, the organization should consider safely disposing of it.” Securely disposing of personal information
As organizations and institutions get on the “Big Data” bandwagon, the push to amass enormous volumes of personal information for yet undetermined purposes has never been greater. The capacity and desirability to retain massive amounts of personal information indefinitely increases the risks and consequences of a potential data breach. “Organizations shall develop guidelines and implement procedures to govern the destruction of personal information.” When it comes to federal institutions, Section 6 of the Privacy Act provides that “personal information that has been used by a government institution for an administrative purpose shall be retained by the institution for such period of time after it is so used as may be prescribed by regulation in order to ensure that the individual to whom it relates has a reasonable opportunity to obtain access to the information.” Moreover, an institution “shall dispose of personal information under the control of the institution in accordance with the regulations and in accordance with any directives or guidelines issued by the designated minister in relation to the disposal of that information.”
As organizations and institutions get on the “Big Data” bandwagon, the push to amass enormous volumes of personal information for yet undetermined purposes has never been greater. The capacity and desirability to retain massive amounts of personal information indefinitely increases the risks and consequences of a potential data breach. “personal information that is no longer required to fulfil the identified purposes should be destroyed, erased, or made anonymous.” When it comes to federal institutions, Section 6 of the Privacy Act provides that “personal information that has been used by a government institution for an administrative purpose shall be retained by the institution for such period of time after it is so used as may be prescribed by regulation in order to ensure that the individual to whom it relates has a reasonable opportunity to obtain access to the information.” Moreover, an institution “shall dispose of personal information under the control of the institution in accordance with the regulations and in accordance with any directives or guidelines issued by the designated minister in relation to the disposal of that information.”
As organizations and institutions get on the “Big Data” bandwagon, the push to amass enormous volumes of personal information for yet undetermined purposes has never been greater. The capacity and desirability to retain massive amounts of personal information indefinitely increases the risks and consequences of a potential data breach. “Moreover, Paragraph 4.7.5 specifies that care shall be used in the disposal or destruction of personal information, to prevent unauthorized parties from gaining access to the information.” When it comes to federal institutions, Section 6 of the Privacy Act provides that “personal information that has been used by a government institution for an administrative purpose shall be retained by the institution for such period of time after it is so used as may be prescribed by regulation in order to ensure that the individual to whom it relates has a reasonable opportunity to obtain access to the information.” Moreover, an institution “shall dispose of personal information under the control of the institution in accordance with the regulations and in accordance with any directives or guidelines issued by the designated minister in relation to the disposal of that information.”
Purpose “This information can be in physical or electronic forms.” As organizations and institutions get on the “Big Data” bandwagon, the push to amass enormous volumes of personal information for yet undetermined purposes has never been greater. The capacity and desirability to retain massive amounts of personal information indefinitely increases the risks and consequences of a potential data breach.
Private sector organizations and federal institutions collect personal information about citizens, employees, clients and prospective clients. This information can be in physical or electronic forms. Once this information has been collected, organizations and institutions need to make informed choices about how long to keep it, and when and how to dispose of it. “The capacity and desirability to retain massive amounts of personal information indefinitely increases the risks and consequences of a potential data breach.” Principle 5 of the Personal Information Protection and Electronic Documents Act(PIPEDA) states that “personal information that is no longer required to fulfil the identified purposes should be destroyed, erased, or made anonymous. Organizations shall develop guidelines and implement procedures to govern the destruction of personal information.”Footnote1 Moreover, Paragraph 4.7.5 specifies that care shall be used in the disposal or destruction of personal information, to prevent unauthorized parties from gaining access to the information.Footnote2
Are information holdings periodically being reviewed to determine whether the purpose of the collection has been fulfilled? How often? “Is there an inventory of what personal information is being retained, for which purpose and for how long?” Does personal information exist in multiple copies? Are there back-ups? If so, where are the copies and back-ups stored?