I think you could include that. I imagine the Privacy Commissioner might give you an interesting point of view on this, perhaps on Thursday. It may involve a lot of auditing and checking up on the matter, but to at least have this would give some certainty.
It's rather like saying that there shall be a five-year retention policy by default; it's similar. It's possible, then. You might ask the Privacy Commissioner when he is here.