Retention Policy 2

Hey There!

Welcome to another edition of Privacy Notes!

In the last edition, we started discussing the principle of storage, particularly the “Retention Policy”. This week, we will complete the Retention Policy series by raising several factors which influence the duration in which Personal Data may be retained by a Data Controller or Administrator.

Compliance with the principle of retention is governed by two key elements:

1. Any legal or regulatory requirement to retain the data.

2. An organisation’s legitimate business reasons for retaining the data.

Compliance officers, information managers, record mangers, legal departments, and librarians are just a few examples of portfolios that have completely different roles but commonly share the role of managing their organisation’s records. For the purpose of the legal and regulatory requirements for retaining personal data, most organisations are advised to bear in mind the statute of limitation laws in Nigeria which may influence the retention period of data to be used in certain cases. Where the limitation period for a claim has elapsed, information relating to such claim will no longer be useful and as such may not necessarily be retained by the Data Controller under the “legal requirement to retain data” element. We will briefly discuss the Claims and Limitation Periods that organisations may have to consider before destruction of personal data.

Claims and Limitation Periods

There are various limitation periods for different subject matter claims. Actions based on simple contracts, recovery of debts and arrears of interest, tortuous malfeasance which includes damages for negligence or breach of a duty of care, account stated, etc, must be commenced within a period of six (6) years of the occurrence of the injury, loss or damage. In this regard, this 6-year limitation period will most likely influence the organisation’s retention period of data relating to such causes of action.

Actions based on any legal instrument under seal especially where such legal instrument relates to an interest or charge on land, or the arrears of an annuity charged on an immovable property, or the enforcement of an arbitration award where the Arbitration Agreement is under seal, or the judgment of a competent Court of Law, etc, must be commenced (or where a judgment or award is to be enforced) within a period of twelve (12) years from the period when the cause of action arose or the judgment or award was entered.

The limitation period for other kinds of legal actions are:

a) Twenty (20) years for a State Authority to bring a legal action to recover land.

b) Twelve (12) years to make any claim arising from a deceased person’s personal estate.

c) Two (2) years to recover any damages against concurrent wrongdoers under any civil liability enactment.

d) Three (3) years to file a claim for damages arising from a slander, nuisance, breach of duty of care, etc.

e) Three (3) Months for actions against Public Officers.

Where data is being processed in the course of providing a particular service to a data subject, upon termination of the relationship with the data subject, the data must be considered for either deletion, anonymisation, or suppression to make sure it is not kept on file for longer than required.

If an organization intends to retain the data for a period longer than the limitation period, it may do so only for the purpose of legitimate interest – which could be that such retention will aid the organisation’s ability to handle any future complaints. More practically, medical professionals for instance, will need to rely on accurate patient records to ensure that proper treatment is administered at all times. These instances may fall under “legitimate interest”.

The period for which personal data will be retained by the Data Controller must be communicated to the Data Subject. Furthermore, where a Data Controller cannot determine the duration for which it will need to retain personal data, the criteria used by

the Data Controller for determining such period of retention must be communicated to the Data Subject.

Thank you for reading to this point!

Till Next Privacy Notes Friday,

Uwemedimo Atakpo Jnr.