S.L. 586.8 Art. 5Time-limits for storage and review. 6 [S.L.

(1) Personal data which is no longer required for the purposes set out in regulation 3(1) shall be erased without undue delay. FOR THE PURPOSES OF THE PREVENTION, INVESTIGATION, DETECTION OR PROSECUTION OF CRIMINAL OFFENCES OR THE 586.08 EXECUTION OF CRIMINAL PENALTIES

(2) Without prejudice to any time limits for storing or erasing data provided for by any law, the controller shall establish appropriate time limits for the erasure of personal data or for a periodic review of the need for the storage of personal data. The controller shall be responsible for establishing a data-retention policy, which shall include all the data categories and the respective time-limits.

(3) The data retention policy and any subsequent amendments thereto, shall be reviewed and approved by the Commissioner. The Commissioner may refuse a data retention policy if it does not comply with these regulations.

(4) The controller shall be responsible for establishing the necessary procedural measures, including, but not limited to, the necessary technical arrangements, in order to ensure that the obligations laid down in sub-regulation (2) are met.