A telecom operator stores communications metadata for years to support 'any future investigation that might arise,' with no defined statutory purpose, retention limit, or case linkage. Which assessment best reflects European data-protection principles?
Select an answer to reveal the explanation.
Short Explanation
Think of metadata as a diary of who talked to whom and when—not a junk drawer you keep 'just in case.' European rules expect a clear legal purpose and a real end date, not an open-ended warehouse for unknown future probes. Purpose-free stockpiles are the red flag.
Full Explanation
Communications metadata relating to identifiable subscribers is typically personal data and remains subject to purpose limitation, storage limitation, and lawful-basis requirements under European data-protection law and related ePrivacy frameworks. Retention solely for undefined future investigations lacks the specificity and necessity those principles demand. Controllers and operators must ground interception or retention programmes in clear law, defined purposes, and proportionate limits rather than indefinite, open-ended archives.