Data Minimization Meets Defensible Disposition: Just Say No to ROT and Over-Retention of Personal Information

Continued ownership of digital debris constitutes a significant and growing expense. Raw storage space may be cheap, but due to the increasing costs of security, labor, migration, maintenance, etc., the total cost of ownership of enterprise data has trended upward. Even if the trend reverses, the trajectory of increasing data volumes is unlikely to abate. Indeed, enterprise data is currently doubling every 24 months.

Moreover, obsolescent data can have negative value due to the possibility of a data breach. Unnecessary retention of personally identifiable information (PII), protected health information (PHI), payment card industry data (PCI), and a host of other consumer, employee, and business information exposes organizations to criminal, civil, and regulatory penalties. While legislative and regulatory activity had historically been focused on relatively established requirements of what organizations must keep (e.g., for tax purposes), legislators and regulators are now also focused on quickly evolving requirements of what data organizations may obtain, the manner in which they obtain it, for how long they may keep it, and how they must protect such data. Consequently, organizations are not simply spending money to store data that lacks value; they are spending money to perpetuate latent liabilities that grow more serious with time.