A question came up pertaining to the system reports that are used to develope a list of customer's that we market to. Monthly we provide an extract of our database to a centralized area. They combine it with other channels. Marketing then uses this data to cross sell and the data will be used for annual privacy notice mailing. This unit wants to refreash the system every month and delet old data. Since opt out information is included in the list provided how long must this centralized unit keep the data we provided? I was thinking 2 years for the marketing side but concerned that if audited how they proved who received privacy notices. Any comments are appreciated.

While there are no specific retention requirements in the Privacy regulations, I would think that you would want to maintain your records of who received the annual mailing at least year-to-year. Depending on what "other channels" entails, if this involves prescreening, the retention would be for 25 months under Regulation B for the other information.

Thanks. That helps.