The Retention Cliff in a Subscription Migration
A UK-based streaming education platform is migrating 240,000 learner accounts from a legacy CRM to a new system. The legacy CRM contains 6 years of activity logs, payment histories, and support tickets. The migration team plans to copy everything into the new system to 'preserve the full customer journey'. The DPO notes that the privacy notice states activity logs are kept for 24 months and payment records for 7 years for tax purposes. Marketing wants the old activity data to build lookalike audiences. The migration go-live is in 3 weeks and the team argues that filtering records will delay the project and risk breaking reporting dashboards. A junior analyst asks whether copying everything is acceptable because 'it was lawfully collected originally'.
1. Identify the data protection principles most at risk in this migration and explain why 'it was lawfully collected originally' is not a sufficient justification.
Read the worked answer
The key principles at risk are storage limitation and purpose limitation, with accuracy and security as secondary concerns.
- Storage limitation: The privacy notice commits to 24-month retention for activity logs. Copying 6 years of logs into the new system extends retention beyond what was communicated and what is necessary. The lawful basis for original collection does not reset the retention clock.
- Purpose limitation: Reusing activity data for lookalike audience building is a new purpose. Compatibility with the original purpose must be assessed; marketing profiling is unlikely to be compatible with service delivery without a fresh lawful basis and transparency.
- Lawful basis does not travel automatically: Consent (if relied upon) is purpose-specific and may not cover the new use. Even with legitimate interests, a balancing test is required for the new purpose.
The analyst's reasoning confuses lawful at collection with lawful to continue processing. Each processing operation needs a current justification, and retention must be justified against necessity. The migration should filter records to the stated retention periods, document the deletion of out-of-scope data, and separately assess any marketing reuse with a DPIA-lite and updated notice.
2. The team proposes a compromise: migrate everything but 'archive' the old logs with access restricted to the analytics team. Evaluate whether this resolves the compliance issue.
Read the worked answer
Partially, but not fully. Restricted access and archiving can support security and reduce risk, but they do not cure storage limitation or purpose limitation.
- Storage limitation: Keeping data 'just in case' in an archive still constitutes storage. Unless there is a specific legal or contractual obligation, or a documented justification (e.g., legal claims), indefinite archiving of 6 years of activity logs exceeds the stated 24 months. An archive is not a retention exemption.
- Purpose limitation: If the analytics team can use the archived logs for lookalike modelling, the new purpose remains unaddressed. Access controls do not create a lawful basis.
- Transparency: The privacy notice says 24 months; retaining longer without informing individuals is misleading.
A defensible compromise: define a short, fixed archive period (e.g., 3 months) for migration validation only, with no marketing use, documented in the migration plan; delete at the end. For any genuine analytics need, aggregate or pseudonymise and assess compatibility. Record the decision in the ROPA.