The DPA's Strict View On Retention Periods

End of July, the Austrian Data Protection Authority ('DPA') published its first decision on retention periods applying the General Data Protection Regulation ('GDPR'; DSB-D216.471/0001-DSB/2018). The decision is final. The DPA had to decide for which period a provider of telecommunications services (hereinafter: the 'controller') may (respectively must) retain so called master data, required for the controller's legal relationship with the user of its services (hereinafter: the 'applicant').

The controller retained the applicant's master data for ten years. The controller claimed it is lawful to retain such data based on section 207 (2) of the Austrian Federal Fiscal Code (BAO).