1. www.egi.eu EGI-InSPIRE RI-261323 EGI-InSPIRE www.egi.eu EGI-InSPIRE RI-261323 Enforcement of the personal data retention policy Peter Solagna, EGI.eu WLCG Ops Coordination 2013-03-07 v.1.0

2. www.egi.eu EGI-InSPIRE RI-261323 Current Personal data retention policy The current policy requires the following: –“The Accounting Data Centre is responsible for deleting the copies of the individual accounting records in the central database, or for removing or anonymising personal id entifying information, e.g. the CommonName or e-mail components of subject DNs, from these records, at the latest one year after receipt of the data in the ADC. Personal identifying information contained in aggregated data must be treated in the same way” –Accounting Data Centre: central APEL database, NGI accounting databases where available –In the APEL database, anonymous summaries of all records from the beginning of time will be preserved OMB proposes to extend the data retention period to 18 months

3. www.egi.eu EGI-InSPIRE RI-261323 Enforcement of the policy OMB proposal Enforcement of the 18 months policy starting from 2013-07-01 After this date, clean-up performed on a monthly base NGIs with an accounting repository must enforce the policy as well VO users will be notified about the enforcement calendar at least one month in advance Feedback expected by 2013-03-08 –WLCG has been notified about this proposal