“What would the appropriate retention period be for references that we as an employer give to third parties on an employee’s request (e.g. to prospective employers)?” Under Article 5(1)(e) of Assimilated Regulation (EU) 2016/679, UK General Data Protection Regulation (UK GDPR), personal data must be kept in a form which permits identification of data subjects for no longer than is necessary for the purposes for which the personal data are processed (storage limitation principle). As set out in the Information Commissioner’s Office (ICO) guidance (Principle (e): Storage limitation) the storage limitation principle is closely linked with the data minimisation and accuracy principles. Ensuring that an employer erases personal data when it no longer needs it will reduce the risk that it becomes irrelevant, excessive, inaccurate or out of date. In addition, personal data held for too long will, by definition, be unnecessary. An employer will need to consider what is the lawful basis or condition for retention, and for how long it remains necessary to retain the personal data for that lawful basis. A retention policy may assist an employer in this regard. According to the ICO guidance employers and other controllers: • must not keep personal data for longer than they need it • must think about, and be able to justify, how long they keep personal data. This will depend on their purposes for holding the data • need to have a policy setting standard retention periods wherever possible • should periodically review the data they hold, and erase or anonymise it when they no longer need it • must carefully consider any challenges to their retention of data. Individuals have a right to erasure if the employer no longer needs the data The guidance also says that an employer or other controller should consider: • its stated purposes for processing the personal data. It can keep the data as long as one of those purposes still applies, but it should not keep data indefinitely ‘just in case’, or if there is only a small possibility that it will use it • whether it need to keep a record of a relationship with the individual once that relationship ends. The employer may not need to delete all personal data when the relationship ends. It may need to keep some information so that you can confirm that the relationship existed—and that it has ended—as well as some of its details • whether it need to keep information to defend possible future legal claims. However, it could still delete information that could not possibly be relevant to such a claim. Unless there is some other reason for keeping it, personal data should be deleted when such a claim could no longer arise • any legal or regulatory requirements. There are various legal requirements and professional guidelines about keeping certain kinds of records—such as information needed for income tax and audit purposes, or information on aspects of health and safety. If the employer keeps personal data to comply with a requirement like this, it will not be considered to have kept the information for longer than necessary • any relevant industry standards or guidelines While an employer may need to retain some of the former employee’s personal data in order to provide a reference to other prospective employers, it should consider whether (and for how long) it is necessary to retain a copy of a reference it has already provided, and for what purpose. Typically keeping references for a period of around 6-12 months after issue would likely be considered reasonable in all of the circumstances. Don’t forget, as an RMI member you have access to the RMI Legal advice line, as well as a number of industry experts for your assistance. Should you find yourself in the situation above, contact us at any stage for advice and assistance as appropriate. Motor Industry Legal Services Motor Industry Legal Services (MILS Solicitors) provides fully comprehensive legal advice and representation to UK motor retailers for one annual fee. It is the only law firm in the UK which specialises in motor law and motor trade law. MILS currently advises over 1,000 individual businesses within the sector as well as the Retail Motor Industry Federation (RMI) and its members.