In response to a number of queries on retention, I’ve had a wee think and come up with three little rules for you to follow, and a little advice on what else to do.
1) Keep sufficient for audit purposes for six years following the end of the current year – this is fairly standard for audit purposes in both the public and private sectors.
2) Keep unused material according to CPIA rules.
3) Everything else – keep only as much as you need, and keep it for just as long as you need it (DPA rules).
We suggest that prosecution paperwork is kept for six years following release from prison, six years where there is a conviction but no prison term or two years if there was an acquittal or the case was withdrawn.
If your information is held on a system then bulk retention for a six-year period seems acceptable, as long as you have a process for removing unnecessary material (spurious or malicious) sooner, if you deem it reasonable ; you should also ensure that anything that is required beyond that period can be retained.
If you wish to keep material (intelligence) for a long period of time, there is a police scheme called the National Retention Assessment Criteria. It’s quite helpful, although (obviously) aimed at the police so… The key points are:
• How much is an individual’s privacy invaded by retaining their personal information? This must satisfy the proportionality test.
• Before disposal, you should be confident that any records you dispose of are no longer necessary for investigative purposes.
• You should have a consistent approach to retaining investigation information. Creating and following a process (an a process map) is key to this.
• Generally there is no issue with searchable records (as long as they are accurate, adequate, up to date and necessary) being held for a minimum of six years from the date of creation. These are used, for example, to identify offending patterns over time, and to help guard against individuals’ efforts to avoid detection for lengthy periods
• Retention beyond the six-year period should only happen following a review, if it is clear that it is still necessary to keep the record for your purposes. The NRAC template may be useful in helping to establish whether or not information is still needed for a legitimate purpose.
Auntie