- Mihaela Cracea
- May 20, 2024
- 5 min read
The storage of personal data is an ongoing concern for those who manage information, as the circumstances requiring the processing of such data are never identical, not always predictable, and the terms for which processing is permitted are not always clear. Regulation 679/2016 on the protection of individuals with regard to the processing of personal data ("GDPR") establishes, among other principles, the principle of "data storage limitation" according to which personal data should be "kept for a period not exceeding the period necessary to fulfill the purposes for which they are processed."
What necessarily results from this principle of limiting data storage periods is nothing other than the right of data subjects to have their personal data erased as soon as they are no longer needed for processing for a specific purpose, without any action required on their part, without the need to address data controllers with a request to do so (a right we intend to discuss in a future article).
In other words, the removal of personal data from the records of the data controller will always occur upon expiration and in close correlation with the identified and established storage period for each category of data processing.
The answer to the question "how long should personal data or a document containing personal data be stored?" should always prompt the data controller to clearly and objectively identify until when those data are needed.
A series of questions can help in this regard:
What is the reason for processing this data?
At what point has the objective I set been objectively and finally achieved?
Beyond this point, are personal data still necessary for another purpose that requires a longer storage period, such as financial-accounting purposes, archival purposes in the public interest, historical research, or statistical purposes?
Thus, the GDPR considerations mention that "processing personal data for purposes other than those for which personal data were initially collected should be allowed only when processing is compatible with those respective purposes for which personal data were initially collected. In this case, a separate legal basis from that on which the collection of personal data was allowed is not necessary. Subsequent processing for archiving purposes in the public interest, scientific or historical research purposes, or statistical purposes should be considered as lawful processing operations. The legal basis provided in Union law or in national law for the processing of personal data may also constitute a legal basis for further processing. In any case, the application of the principles established by this Regulation and, in particular, informing the data subject about these other purposes and their rights, including the right to object, should be guaranteed."
Below, we propose a brief analysis of some situations involving the processing of personal data related to documents submitted by employees in support of certain requests made to employers and whose storage periods are not very clear to employers:
Processing/storing copies of death certificates of a close relative or for the marriage of a child to grant paid leave for family events or to prove absence from work in unforeseen situations, caused by a family emergency due to illness or accident, which makes the immediate presence of the employee indispensable. Should these copies be included in the personnel files and archived for the period required by the legal provisions for them?
Considering:
That the purpose of presenting these documents by the employee is to justify the existence of the event for which the employer grants leave, so that the employee is not considered absent to work;
the non-impairment in any way of salary rights or contribution periods in the pension or health system;
the legal provisions establishing the content of the employee's personnel file, namely: the documents necessary for hiring, the individual employment contract, the additional acts and other documents regarding the modification, suspension, and termination of individual employment contracts, study documents/qualification certificates, as well as any other documents certifying the legality and correctness of the completion in the register,
we consider that the inclusion of these documents in the personnel files and archiving them together is not justified.
Therefore, as soon as the information from these documents has been verified by the human resources staff of the employer and it is found that they coincide with the information provided by the employee in the request submitted to the employer regarding the granting of those days off, these documents, excluding the request itself, should be definitively deleted/destroyed from the internal records of the employer, there being, from our perspective, no other reason for the employer to proceed to keep these documents for longer periods.
However, the situation of processing personal data and documents collected by employers in the case of granting caregiver leave regulated by the Labor Code is different.
According to the provisions of the Labor Code, correlated with those of Order of the Ministry of Labor and Social Protection no. 2172/3829/2022 regarding the granting of caregiver leave (the Order), the requesting employee of this leave has the obligation to prove, both the existence of the kinship relationship with the person being cared for or cohabitation, and the existence of the serious medical problem that prompted the employee to request caregiver leave.
The documents through which these proofs are made are regulated by the Order and are, as the case may be: the identity card, the birth certificate, the marriage certificate, the document by which the person was taken into space, the certificate from the association of owners/tenants or the employee's own statement indicating that the person cared for by the employee lives in the same household with him/her for at least the period of caregiver leave, the hospital discharge ticket or, as the case may be, the medical certificate issued by the attending physician or the family doctor of the person with serious medical problems.
To establish the storage period of these documents, both the purpose for which this data was initially collected and a possible existence of a subsequent purpose that would require a longer processing of personal data, beyond the limit of the initial purpose for which they were collected, should be analyzed.
Thus, in the described situation, analyzing the legal provisions regulating these rights, we will identify both an initial purpose of processing, namely that of granting days off, but also a subsequent purpose to the first one, namely that of fulfilling the financial-accounting obligations. The latter results from the provisions of the Labor Code, which establish that employees who benefit from caregiver leave are insured, during this period, in the social health insurance system without paying contributions.
Therefore, as long as maintaining health insurance rights usually implies contributing to this system, mandatory when paying salary rights, any deviation from this provision must be proven. Therefore, in order to prove the non-payment of social security contributions of the employee for the period of caregiver leave, in the event of a possible inspection by the fiscal authorities, the processing of this personal data and implicitly of the documents containing it should be carried out for the period of prescription of the right to action in the fiscal field, namely 5 years from July 1 of the following year for which the fiscal obligation is due, a term also instituted by the provisions of Law no. 36/2023 amending the Accounting Law.
