Miscellaneous Retention of personal data under the Market Abuse Regulation
Under MAR, there are certain reporting requirements firms must comply with, to provide the FCA with the information they need to identify, prevent and tackle cases of market abuse. When complying with their reporting obligations, firms will often share personal data with the FCA. Personal data is information that relates to an identified or identifiable individual.
	For example, some firms have a responsibility to report suspicious transactions to the FCA. When reporting the transactions, firms will provide the FCA with personal data such as names or account numbers, in order to identify the individual that carried out the transaction.
	Currently, Article 28 of MAR limits the amount of time the FCA can hold personal data processed for the purposes of tackling market abuse to five years. The Act amends MAR to remove the limit on the FCA holding MAR personal data for more than five years. This allows the FCA to hold personal data in line with the General Data Protection Regulation (GDPR).
	The UK General Data Protection Regulation (UK GDPR) is part of the UK’s data protection landscape that includes the Data Protection Act 2018 (the ‘DPA 2018’). The UK GDPR sets out requirements for how organisations, including the FCA, need to handle personal data.
	The GDPR specifies the data minimisation principle, where data held by organisations must be, among other things, limited to what is necessary.
	In some circumstances, the FCA needs to retain personal data for longer than five years, for example to investigate complex market abuse, to prosecute those cases and to enable the FCA to discharge its disclosure duties in certain prosecution cases by providing relevant information to the defendants which may support their case. This can occur over a prolonged period of time, which can be longer than five years.