Organizations are taking a closer look at their data retention policies and how those policies intersect with requirements for data privacy and minimization as regulators in the United States and abroad focus more on the sometimes-conflicting compliance expectations, two consultants said.

“Privacy is driving this whole idea of data minimization, and it’s driving organizations to create data retention policies,” said Mark Diamond, president and CEO for strategic information governance consulting firm Contoural. “We’re seeing a lot of organizations struggling with this issue—quite frankly, trying to do the right thing but making some mistakes,” Diamond said at a Feb. 1 webinar sponsored by the Society for Corporate Compliance and Ethics.^[1]

Still, Kerry Childe, senior consultant for Contoural, noted that U.S. data protection laws also contain data minimization requirements, even though “these things have not been enforced a lot. Still, we’re starting to see regulators pay more attention to this, and as a result, we’re starting to see companies pay more attention.”

Some of the impetus is coming from Europe, where the enforcement of data minimization is driving new looks at existing processes, Diamond said. In Europe, under the General Data Protection Regulation (GDPR), companies have reported that terminated employees were making broad data requests either for discovery purposes (which are of limited use in Europe) or because of the cost of searching and producing the information, he said.

In one case, Diamond explained, their client heard from its outside counsel that terminated employees were doing this to extract more in settlements. He worried this will happen over here (e.g., in California). “Companies that don’t have control over their personal information or over retained personal information put themselves at risk,” Diamond said.