On the privacy side, for information that's collected legitimately, I believe the standard is a minimum of two years. If the information is not collected for the purpose intended, then I would suspect we wouldn't keep it as long.
On February 7th, 2017. See this statement in context.