Article 91 Data retention

The Agency shall delete personal data as soon as they have been transmitted to the competent authorities of Member States, other Union bodies, offices and agencies, in particular EASO, or transferred to third countries or international organisations or used for the preparation of risk analyses. The retention period shall, in any event, not exceed 90 days after the date of the collection of those data. Data shall be anonymised in the results of risk analyses.

Personal data processed for the purpose of performing return-related tasks shall be deleted as soon as the purpose for which they have been collected has been achieved, and shall be deleted no later than 30 days after the end of those tasks.

Operational personal data processed for the purposes of Article 90 shall be deleted as soon as the purpose for which they have been collected has been achieved by the Agency. The Agency shall continuously review the necessity of storing such data, in particular the personal data of victims and witnesses. In any case, the Agency shall review the necessity of storing such data no later than three months after the start of initial processing of such data, and every six months thereafter. The Agency shall decide on the continued storage of personal data, in particular the personal data of victims and witnesses, until the following review, only if such storage is still necessary for the performance of the Agency's tasks under Article 90.

This Article does not apply to personal data collected in the context of the FADO system.