Enquiry Case Notes

編號: 0043/2014/PA

標題: Establishment of retention period

查詢內容:

    Bureau A consulted the Office for Personal Data Protection (GPDP) for the establishment of personal data retention period.

回覆內容:

    Since Bureau A has not provided the information as stated in Article 23 of Personal Data Protection Act (PDPA), the Office for Personal Data Protection (GPDP) could only provide a general reply.
  According to Article 5(1)(5) of the PDPA, data controller is responsible for establishment of retention period and the beginning date of it.  Bureau A defines the collecting date as a beginning of the retention period, or when a citizen renews the data, and Bureau A treats that renewed date as a beginning of the retention period, which belongs to the internal policy of the Bureau.
  If a specific retention period has been established by a special law for a particular type of archives as processed by public departments, or in relation to archives for administration and ordinary administrative activities of public departments and archives produced for certain activities and statutory duties, public departments should follow the rules stipulated therein to process the archives when establishing the personal data retention period. Otherwise, public departments should establish a specific personal data retention period according to the processing purposes as required by Article 5 of the PDPA and Decree Law 73/89/M. Regarding the establishment of retention period, Bureau A may refer to the administrative rule of the Opinion on consultation of retention period of general archives issued by the General Council of Archives, as well as the Opinion on the data retention period of public files with personal data issued by this Office.

註:
Please refer to “Personal Data Protection Act”, articles 5 and 23.