8.1. Storage period
The storage periods of some types of personal data, such as data related to employment or accounting, have been laid down by law. When this is the case, the data is stored for the statutory period and then erased.
Specific storage periods have not been provided for all types of personal data, however. In such cases, the controller must determine how long each type of personal data will be stored. The rule of thumb for determining the storage period is to only store personal data for as long as necessary for the purpose for which it was collected. Data must be erased when there are no grounds for processing them any more and they are not need for the organisation of hobby activities.
The sensitive nature of the data and the potential risks caused to the participants by its disclosure must be taken into account in the storage of special categories of personal data. In particular this must be taken into account when it comes to children’s health information. Health data must be stored so that outsiders cannot access it and may not be disclosed to people who do not need it.
A good way for controllers to define the storage period for personal data is to review all types of personal data being processed and examine the purpose of processing each type in each connection. The controller can then define storage periods for each item or type of personal data based on their purpose. When determining storage periods, the hobby organiser must also take into account different scenarios, such as when someone quits the hobby. Some data can be erased immediately when the participant quits.
