The longer you keep information, the more there's a risk in terms of a privacy breach and the more there is an impact if there's a privacy breach. One of the principles we put forward is to not retain information longer than is necessary. Again, that's why necessity and proportionality are so important. There will be cases where you need to keep it longer, but that should be tested in every case.
