Guidelines 1/2020 on processing personal data in the context of connected vehicles and mobility related applications

Subparagraph 3.1.1.3  Retention period

110. In the context of data processing taking place for the performance of a contract (i.e.provision of a service), it is important to distinguish between two types of data before defining their respective retention periods:

• − commercial and transactional data: those data can be retained in an active database for the full duration of the contract. At the end of the contract, they can be archived physically (on a separate medium: CD-ROM, etc.) or logically (by authorisation management) in the event of possible litigation. Thereafter, at the end of the statutory limitation periods, the data shall be deleted or anonymised ;

• − usage data: usage data can be classified as raw data and aggregated data. As stated above, if possible, data controllers or processors should not process raw data. If it is necessary, raw data should be kept only as long as they are required to elaborate the aggregated data and to check the validity of that aggregation process. Aggregated data should be kept as long as it isnecessary for the provision of the service or otherwise requested by a Union or Member state law.