A telecom operator stores communications metadata for years to support 'any future investigation that might arise,' with no defined statutory purpose, retention limit, or case linkage. Which assessment best reflects European data-protection principles?
Select an answer to reveal the explanation.
Short Explanation
Think of metadata as a diary of who talked to whom and when—not a junk drawer you keep 'just in case.' European rules expect a clear legal purpose and a real end date, not an open-ended warehouse for unknown future probes. Purpose-free stockpiles are the red flag.
Full Explanation
A telecom operator storing communications metadata for years to support ‘any future investigation that might arise,’ with no defined statutory purpose, retention limit, or case linkage, best reflects that indefinite, purpose-free retention of communications metadata conflicts with purpose limitation, storage limitation, and the need for a clear legal basis for surveillance-related processing. Metadata diaries of who contacted whom are not junk drawers for unknown future probes. Claiming metadata is never personal data fails typical subscriber identifiability. Saying keeping metadata forever is always lawful if labelled national security fails—labels without legal basis and limits do not satisfy European principles. Asserting billing collection forever authorises any public-authority reuse without further legal analysis fails purpose limitation. Exam caveat: retention mandates must come from clear law with proportionate limits; operators should not self-invent open-ended investigative warehouses beyond what law requires. Operational check: map each metadata store to a statutory purpose and retention clock, separate billing from investigatory retention, delete expired data, and refuse purpose-free ‘keep everything’ programmes.