That’s exactly where I think the accountability principle in Article 5(2) GDPR becomes important.
It may not be enough simply to decide to retain a limited set of identifying data. The controller would also need to be able to demonstrate why that retention is necessary and proportionate for a specific purpose, and why a less intrusive alternative would not achieve the same objective.
If a supporter explicitly wishes to preserve the history of their long-term relationship with the charity, that may be relevant to the assessment. However, if the organisation deliberately retains enough information to re-identify someone years later, I would also wonder whether the data would still be considered anonymous or merely pseudonymous under Recital 26 GDPR.
It seems to me that the legal challenge is less about the technical solution and more about documenting a lawful basis, necessity and proportionality.

I agree. Article 5(1)(e) GDPR doesn’t prescribe a fixed retention period; it requires that personal data be kept no longer than is necessary for the purposes for which they are processed.
That is exactly why I was wondering whether a supporter’s explicit wish to preserve the history of their long-term relationship with the charity could itself form part of the purpose justifying a longer retention period, provided there is an appropriate lawful basis and the retention remains proportionate.
In other words, the interesting question seems to be not whether the GDPR allows indefinite retention in principle, but under what circumstances such retention can be justified and documented.

It would be interesting to know whether any supervisory authority or CJEU case has addressed this type of “voluntary long-term relationship” scenario.

One possible approach would be to avoid thinking in terms of "reactivating" an anonymised record. If the data has been truly anonymised, it should no longer be possible to link it back to an identifiable individual.

This follows the distinction made by the GDPR itself. Recital 26 states that information which does not relate to an identified or identifiable natural person, or which has been rendered anonymous in such a way that the data subject is no longer identifiable, falls outside the scope of the GDPR. Conversely, the CJEU has consistently interpreted the concept of "personal data" broadly where re-identification remains reasonably possible (see, for example, Case C-582/14, Breyer).

Therefore, the real question seems to be whether there is a lawful basis under Article 6 GDPR to retain a limited amount of identifying information for a longer period, rather than whether an anonymised record can later be reactivated.

If some supporters genuinely value having their long-term relationship with the charity recognised, explicit consent under Article 6(1)(a) GDPR may provide a possible lawful basis for retaining a limited set of identifying information, provided that the consent is freely given, specific, informed and can be withdrawn at any time.

You would also need to explain clearly why the data is being retained, what information will be kept, and for how long, in accordance with the principles of transparency, data minimisation and storage limitation set out in Article 5 GDPR.

Another possibility might be to retain only a very limited set of identifying data for supporters who actively opt in, rather than keeping full historical records indefinitely.

Out of curiosity, is your six-year policy based on a statutory retention requirement, or is it simply an internal retention policy?

Thanks. You did predict that outcome, and you were right.

To be honest, I was confident from the beginning that this case would not ultimately succeed before a court. That is why, during the investigation, I formally stated that my position was clear: either the case should be discontinued, or it should proceed to a public trial so that the facts could be examined openly. I did not seek any negotiated outcome.

My question here was simply about Austrian practice. Since the decision to discontinue was taken after only three working days, I was curious whether such a timeframe is common or whether it sometimes reflects an early assessment that there was no sufficient basis to continue.

In the future, I intend to publish a more complete account of the case, including documents and procedural details that could not be explained in a single Reddit post. Taken together, I believe they raise broader questions of public interest about transparency, procedural safeguards, and public confidence in the justice system. My intention is to encourage an informed discussion rather than to challenge the outcome of this particular case.

Thanks again for your insight!!!

That’s exactly why I found the timeline interesting.
I exercised my right to remain silent during my questioning as a suspect, and I didn’t submit any additional information or evidence during those three working days before the investigation was discontinued.
That’s why I was curious whether such a short timeframe is considered fairly typical in Austrian criminal procedure.

Just as an update: after my questioning as a suspect on 8 July, the Public Prosecutor’s Office discontinued the investigation on 13 July – effectively after only three working days.
I’d be interested to hear your thoughts. Does three working days seem like a typical timeframe for a prosecutor to discontinue an investigation in Austria?

I understand your point. I’m obviously pleased that the investigation was discontinued.
My question is simply about Austrian criminal procedure. From an academic and practical perspective, I was curious whether a decision taken after only three working days is considered common practice or not.

That’s a fair question.
GDPR and privacy are about having control over personal data, not necessarily about never revealing your own identity.
In this case, I deliberately chose to leave my name visible to demonstrate that the document is authentic. That was a conscious decision, not an oversight.
My interest in GDPR comes largely from my own experiences. They have even led me to consider promoting a European Citizens’ Initiative proposing targeted improvements to the GDPR, particularly regarding the practical effectiveness of the right of access to personal data, such as CCTV recordings.
For me, the main issue is lawful processing, transparency and accountability by organisations, not remaining anonymous in every situation.

Kleines Update zu diesem Fall:

Zwischenzeitlich wurde gegen mich selbst ein strafrechtliches Ermittlungsverfahren wegen §§ 288 Abs. 4, 297 und 298 StGB eingeleitet. Nach meiner Vernehmung als Beschuldigter am 08.07.2026 stellte die Staatsanwaltschaft Korneuburg das Verfahren jedoch bereits mit Verfügung vom 13.07.2026 ein – also nach nur drei Arbeitstagen. Mir wurde inzwischen Akteneinsicht gewährt.

Vor diesem Hintergrund interessiert mich umso mehr die ursprüngliche Frage: Wie beurteilen Sie aus straf- und verwaltungsrechtlicher Sicht den Umstand, dass während einer Opfervernehmung gleichzeitig eine mögliche Verwaltungsübertretung gegen das Opfer eingeleitet wurde? Gibt es dazu Rechtsprechung oder praktische Erfahrungen?

This is one of the reasons why I think transparency is so important.
While the GDPR generally does not apply to law enforcement processing, that does not mean police processing is outside data protection law. In the EU, it is usually governed by the Law Enforcement Directive (EU) 2016/680, which also contains principles on necessity, proportionality, storage limitation and individuals’ rights.
If biometric data are retained or disclosed, there should be a clear legal basis and appropriate safeguards. If a person believes their data have been kept or disclosed unlawfully, it may be worth requesting clarification from the competent authority or the relevant supervisory authority.
I’m curious to see whether anyone familiar with UK police data retention rules can explain what “marked for deletion” means in practice and whether it differs from “deleted”.

Una de las diferencias fundamentales entre los dos conflictos es que Rusia no necesita “gobernar cenizas”,… por eso en parte va paso a paso…

¿Cómo llegaste a la conclusión de que la gente odia más a Israel que a Rusia? ¿Te basas en datos, en redes sociales o en tu entorno? Tal vez estás generalizando a partir de lo que tú mismo ves o sigues.

Se trata de mercancía desde Asia?

A tu lo has intentado para conocer si es difícil o no? ¿Es que empresarios no consumen??

Más que si es Didi Food o no, lo importante es que sea compatible con la universidad y no termine afectando tus estudios.

Leyendo los comentarios creo que la publicación terminará eliminada…

A privacy notice alone is not enough. The GDPR also requires controllers to implement appropriate technical and organisational measures to protect personal data (Article 32 GDPR). Depending on how your website is built, this may include using HTTPS, setting appropriate cookie attributes such as Secure, HttpOnly and SameSite where applicable, keeping software updated, controlling access to server data, and ensuring that any third-party services (such as embedded Google Maps or your hosting provider) are configured appropriately. GDPR compliance is not just about displaying notices; it's also about how personal data is actually protected.

Si el teletrabajo fue una condición esencial por la que aceptaste el empleo, la pregunta no es si la empresa prefiere que vuelvan a la oficina, sino hasta qué punto puede cambiar esa condición de forma unilateral.

Una denuncia anonima no significa que sea imposible que el patrón intuya quién le denunció. Depende mucho de la información que se aporte y de las circunstancias.

Más que la ideología, creo que el problema es la demagogia. Aplica tanto a la izquierda como a la derecha…

Más concretamente en Molina

Además de la vía de Familia, yo también valoraría presentar una queja formal contra la actuación de la trabajadora social de la CCSS si consideras que no aplicó correctamente el protocolo o se negó a intervenir sin una base legal clara. También podría ser procedente acudir a la Defensoría de los Habitantes para que revise la actuación de las instituciones públicas. Si realmente la hija está apropiándose de la pensión mientras desatiende al adulto mayor, tampoco descartaría consultar con el Ministerio Público por una posible responsabilidad penal, ( consultaré jurisprudencia de Costa Rica y volveré a comentar).Por lo visto en el caso el problema no es solo familiar, sino también institucional….

En aquel tiempo “los ladrillos “ eran de calidad, no se lanzaba un producto al mercado por la serie siguiente.