Information Security Stack Exchange is a question and answer site for information security professionals. It only takes a minute to sign up.
Sign up to join this community
"Outdated personal data" is number 8 on the OWASP Top 10 Privacy Risks, and also the OECD Privacy Principles mention that data should be kept up to date:
Personal data should be relevant to the purposes for which they are to be used, and, to the extent necessary for those purposes, should be accurate, complete and kept up-to-date.
Why is outdated personal data a privacy risk? Wouldn't you have more privacy if other parties have outdated or incomplete data on you?
It allows to build a history. When I got five different datasets about you from five different sources which list three different addresses, I know that you seem to be someone who moves a lot, which can have various reasons. When I can pinpoint that a while ago your last name changed and shortly afterwards your address changed as well, it tells me you either married or got divorced. So I will spam you either with household items or dating sites.
It gives me more material to link datasets together. When I have one dataset from you with an outdated telephone number and another old dataset which is anonymous except for the same outdated telephone number, I can link them to each other.
It also allows identity theft in cases where personal information is used to identify you. For example, you might have some old email account you don't use anymore. When I would hack that account somehow, you wouldn't even notice. But maybe there are still some websites where you have accounts bound to that old email account. I could now use the "forgot password" function of these websites to take over your accounts.
However I still agree that less data is better than more and that one should generally avoid to have more data about them in some databases than strictly necessary.
