European Union: Ruling in CJEU Case C-77/21 on GDPR purpose and storage limitation regulation

On 20 October 2022, the Court of Justice of the European Union (CJEU) issued a preliminary ruling in Case C-77/21 on the interpretation of the GDPR's purpose (Art.5(1)(b)) and storage limitation (Art.5(1)(e)) principles. The reference for a preliminary ruling was filed by the Hungarian Budapest-Capital Regional Court, and concerned the data processing practices of a leading Hungarian internet service provider. The provider had created a database copying existing customer data with the intention of carrying out tests to fix certain technical errors. The CJEU ruled that it was compatible with Art.5(1)(b) to create databases containing copied customer data for the purposes of carrying out tests or implementing technical fixes. However, the storage limitation principle prohibits the retention of such a database after testing has been completed or technical errors have been fixed.