Part 3: Law enforcement processing Chapter 2: Principles Section 39: The fifth data protection principle
The fifth principle (section 39) requires that personal data be kept no longer than is necessary. To comply with this principle, data controllers should establish time limits for erasure, or for periodic review. As with the 1998 Act, this section does not specify minimum or maximum periods for the retention of data. In practice, to comply with the fifth principle, data controllers should review the length of time they retain personal data; consider the law enforcement purpose or purposes they hold information for in deciding whether, and if so for how long, to retain it; securely delete information that is no longer needed for law enforcement purposes; and update, archive or securely delete information that goes out of date. The retention of certain information for law enforcement purposes is governed by statutory rules. For example, in England and Wales, Part 5 of the Police and Criminal Evidence Act 1984 makes provision for the retention of fingerprints and DNA profiles. The retention periods vary depending on whether or not an individual has a conviction for an offence, for example, in the case of an adult convicted of a recordable offence his or her fingerprints and DNA profile may be retained indefinitely. The College of Policing’s Management of Police Information provides a framework for the review, retention or disposal of the generality of information held by police forces in England and Wales for law enforcement purposes.