The Data Use Retention and Disposal Episode

Introduction to the Guest and Topic:
Host Ally Krings welcomes Mark Hinely, Vice President of Privacy Assurance Services at KirkpatrickPrice. The episode focuses on the critical components of data governance: data use, retention, and disposal. Mark shares his background as an attorney and his journey into cybersecurity, emphasizing the ethical responsibility organizations have to protect personal data.

What is Data Use?:
Data use refers to any action taken with personal information—accessing, storing, transmitting, or combining it. Whether it’s signing up for a library card, receiving healthcare, or making a purchase, personal data is constantly being processed. GDPR refers to this as “data processing activity,” and it encompasses virtually every interaction involving personal information.

What is Data Retention and Disposal?:

• Retention is the decision of how long to keep data.

• Disposal involves securely removing data once it’s no longer needed.
  Mark explains that while physical disposal (like shredding paper) is straightforward, digital disposal is more complex. Simply deleting an app doesn’t mean your data is gone. Organizations often retain data unless explicitly asked to delete it.

• 23andMe Bankruptcy: Sensitive DNA data was put up for sale during bankruptcy proceedings.
• Deidentification Risks: If data isn’t thoroughly anonymized, it can be reassembled and traced back to individuals.
• Legal Holds: In litigation, data must be preserved exactly as it was, creating exceptions to standard retention policies.

How Can Individuals Protect Their Data?:

• Request Deletion: Users should actively ask companies to delete their data, especially if no longer using the service.

• Set Personal Retention Policies: Mark recommends individuals do annual “data purges” on their phones and devices.

• Be Mindful of Consent: Understand what you’re agreeing to when sharing data—especially with apps and websites.

How Can Organizations Ensure Compliance?:

• Automated Deletion Tools: Organizations can use scripts and functions to identify and delete expired data.
• Retention Policies: Data should only be kept as long as necessary. Laws, contracts, and business processes can help define appropriate retention periods.
• Access Controls: Sensitive data should be restricted to only those who need it, especially during litigation holds.