When Companies Store Personal Data Longer Than Necessary And Get Sued For It
Companies gather personal information for many reasons, such as employment, financial transactions, online accounts, customer service, security, mobile apps, and healthcare. However, having a valid reason to collect data does not mean a company can keep it forever. Holding onto sensitive information after it is no longer needed can raise the risk of identity theft, data leaks, cyberattacks, and misuse. Some state privacy laws set clear limits on how long certain data can be kept, while others require companies to only collect and use information as needed for specific purposes. If keeping data too long causes harm or breaks a law that lets individuals take legal action, our cybersecurity lawyers may be able to help affected consumers, employees, customers, and others.
Why Keeping Personal Data Too Long Can Become A Legal Problem
A company might need an employee’s Social Security number for payroll, a customer’s payment details to finish a transaction, or a fingerprint scan for workplace access. However, once the original reason for collecting this information is gone, the legal situation can change.
For example, a company might keep a former employee’s fingerprint data in its system years after the person has left. Another business could hold onto customer ID documents after an account is closed. A retailer might store old payment details, addresses, account information, or purchase history even when there is no longer a real business reason to keep them.
Unnecessary retention creates additional opportunities for information to be stolen, improperly disclosed, sold, transferred, or otherwise misused. A database containing information that should have been deleted can turn a cybersecurity incident into a much larger event.
The legal analysis is highly dependent on the type of information, where the affected person lives or worked, why the information was originally collected, what the company’s privacy notices stated, and which statutes apply.
California Law Places Limits On Data Retention
California provides one of the clearest examples of a statutory retention requirement. California Civil Code § 1798.100(a)(3), part of the California Consumer Privacy Act framework, requires covered businesses to disclose how long they intend to retain categories of personal and sensitive personal information, or the criteria used to determine those periods. The statute also provides that information should not be retained for a disclosed purpose longer than reasonably necessary for that purpose. Section 1798.100(c) further requires collection, use, retention, and sharing to be reasonably necessary and proportionate to the relevant purposes.
That does not mean every violation automatically gives an individual a damages lawsuit under the CCPA. The distinction is important. California Civil Code § 1798.150 creates a private cause of action in specified personal-information security breach circumstances, not a general private lawsuit for every violation of the CCPA.
For plaintiffs, the facts therefore matter. We may examine whether excessive retention contributed to an eventual security breach, whether information that should no longer have existed in company systems was exposed, what security measures protected it, and whether additional federal or state causes of action apply.
Illinois Biometric Data Has Specific Destruction Requirements
The stakes become particularly significant when the retained information is biometric. Under the Illinois Biometric Information Privacy Act, commonly called BIPA, private entities possessing covered biometric identifiers or biometric information must establish a publicly available written retention schedule and destruction guidelines. Under 740 ILCS 14/15(a), covered biometric data generally must be permanently destroyed when the initial purpose for collecting or obtaining it has been satisfied or within three years of the individual’s last interaction with the private entity, whichever occurs first, subject to the statute’s provisions.
BIPA also regulates the initial collection and storage of biometric information. Section 15(b) requires specified written disclosures concerning collection or storage, the purpose and length of time for which the information will be collected, stored, and used, and a written release before covered collection occurs.
Unlike many state consumer privacy statutes, BIPA contains a private right of action. Under 740 ILCS 14/20, an aggrieved person may sue an offending party. The statute provides for actual or liquidated damages depending on the nature of the violation, along with attorneys’ fees, costs, and other appropriate relief.
This makes retention practices particularly important when employers or businesses use fingerprint scanners, facial geometry systems, or other technology involving covered biometric identifiers or information.
Data Minimization Laws Can Also Affect How Much Information Companies Keep
Privacy law increasingly focuses on a basic principle: companies should not collect or process more personal information than reasonably needed for a legitimate disclosed purpose.
Virginia’s Consumer Data Protection Act provides an example. Virginia Code § 59.1-578 requires covered controllers to limit personal-data collection to information that is adequate, relevant, and reasonably necessary in relation to disclosed processing purposes. The statute also requires reasonable administrative, technical, and physical data security practices appropriate to the volume and nature of the information.
Virginia consumers also have statutory rights that can include requesting deletion of personal data provided by or obtained about them, subject to the law’s limitations and exceptions.
These statutes illustrate why there is no single nationwide rule stating that every company must delete every category of information after the same number of months or years. Privacy obligations depend on jurisdiction, industry, information type, the purpose of processing, statutory exemptions, and other circumstances.
Federal Law Can Apply To Certain Categories Of Information
Federal law also imposes data-protection obligations in particular industries and contexts.
For example, the Gramm-Leach-Bliley Act states that covered financial institutions have an affirmative and continuing obligation to respect customer privacy and protect the security and confidentiality of nonpublic personal information. The statutory framework calls for safeguards designed to protect information against threats, hazards, and unauthorized access or use that could result in substantial harm or inconvenience. 15 U.S.C. § 6801.
The Federal Trade Commission’s Safeguards Rule similarly requires covered financial institutions within its jurisdiction to maintain a written information-security program containing appropriate administrative, technical, and physical safeguards. 16 C.F.R. § 314.3.
Federal regulatory requirements do not automatically create a private damages claim for every person affected by a violation. We must determine which statutes provide enforceable individual rights and whether state statutory claims, contractual claims, negligence theories, or other causes of action may apply to the particular circumstances.
Keeping Unnecessary Data Can Make A Breach More Harmful
Excessive retention becomes especially significant when a cyberattack occurs. Imagine that a company had 20 years of former employee records on a server even though much of that information no longer served its original purpose. A ransomware attack exposes Social Security numbers, birthdates, payroll information, banking details, and other records belonging to people who left the company years earlier.
One question we would investigate is straightforward: Why was the information still there?
We may examine the company’s retention policies, deletion schedules, cybersecurity procedures, representations made in privacy notices, internal records, applicable regulatory requirements, and whether the organization actually followed its stated policies.
The longer unnecessary information remains available, the longer there may be an opportunity for unauthorized access. Data deletion is therefore not simply an administrative housekeeping issue. Depending on the circumstances, it can be an important component of information security and legal compliance.
What Types Of Retained Data Can Create Serious Risks?
Not all information creates the same degree of harm. We pay particular attention to information that can facilitate identity theft, financial fraud, account takeover, impersonation, or serious invasions of privacy.
That can include Social Security numbers, driver’s license and passport information, bank account and routing numbers, credit and debit card information, usernames and passwords, tax records, employment files, health information, precise location information, fingerprints, facial geometry, voiceprints, and other sensitive identifiers.
Biometric information deserves particular attention because a person cannot replace a fingerprint or facial characteristic in the same way that a compromised password or payment card can be changed.
How We Investigate Excessive Data Retention Claims
When someone contacts us after discovering that a company retained personal information improperly, we first determine exactly what happened. We look at what information was collected, the stated purpose for collecting it, how long the organization kept it, whether the individual consented to the relevant practices, whether deletion was required or requested, and whether the information was ultimately disclosed or stolen.
We also identify which laws apply. A California consumer, Illinois employee, or Virginia resident may have materially different rights. The applicable rules may also change depending on whether the defendant is an employer, financial institution, healthcare organization, technology company, data broker, retailer, or another type of business.
Where legally supported, plaintiffs may seek actual damages, statutory damages, injunctive relief, declaratory relief, or other remedies. Available relief depends on the statute and facts, and some privacy laws are enforceable only by government authorities rather than through individual lawsuits.
National Cybersecurity Lawyers For Personal Data Retention Claims
Companies should not treat personal information as something they can accumulate indefinitely without considering why they still have it, how it is protected, and whether the law requires its deletion. When unnecessary retention contributes to a privacy violation, biometric violation, identity theft event, or data breach, affected individuals may have legal options.
At Net Law Advocates, we represent plaintiffs throughout the United States, please fill out our secure web form or call our firm at 888-913-2318 for your free consultation.
