Add new comment

I beg to differ. Suggest you read the privacy laws very carefully. This is a good summary if you don't want to read everything. Principal 11 is the key area. The entity "must also destroy or de-identify personal information it no longer requires (unless otherwise required to retain it by law)".