Add retention period

[dturnerx]

a defined retention period (in seconds) for the collected data

[smartopian]

This is a long outstanding issue and there was a pin put in this until now.

The reason why this was outstanding is that the field termination - is meant to be controlled and provided by the user in a consent receipt. For all other justifications - Data Retention is a required field from the Data Controller.

Now propose that data retention for the consent receipt is a sub-category of purpose termination and that this is set by the individual or inherits a default as defined by by purpose sub-category field, there is also a requirement for a 'retention rational' sub-field (or meta notice) for the means to be able to figure out or calculate the data retention period for a purpose in the GDPR if it can not be listed as a date and time.

In this regard there seems to be a missing topic in CR discourse around consent preferences - especially in this specific context. ,
! Would data retention - and termination - on a consent receipt be for consent preferences? for non-consent based justifications data retentions would be set by the DC - based on industry best practices, codes of conduct, legitimate interest, contract etc.

[dturnerx]

This may not be required in all jurisdictions so I assume the field should be optional?

[dturnerx]

This was removed from Sprint 3 to allow further discussion on "termination" and "retention" fields.

[dturnerx]

This is the proposal I sent to the mailing list on 08/14/17

Propose 4 new fields - The first two are at the "top" level of the CR and should be used when the fields cover all uses of information. The second two fields are to be included as a subset of a "purpose" and should be used when there are terms unique to that "purpose".

Label: Termination
JSON: termination
JSON type: text
Guidance: specifies the terms or condition for the termination of the consent to use the PII.

Label: Retention
JSON: retention
JSON type: text
Guidance: specifies the terms or condition for retaining PII during the use of the service or following the termination of the consent.

Label: Purpose Termination
JSON: purposeTermination
JSON type: text
Guidance: specifies the terms or condition for the termination of the consent to use the PII specifically related to a related purpose.

Label: Purpose Retention
JSON: purposeRetention
JSON type: text
Guidance: specifies the terms or condition for retaining PII specifically related to a related purpose during the use of the service or following the termination of the consent.