Google appreciates the Garante's incorporation of observations and suggestions received during the public consultation into its guidelines adopted on 6 June 2024. We welcome the fact that the Garante has recognised the vital importance of the security of the IT environment and the need to mitigate security incidents as reasons justifying the retention of email metadata.
This means that the Garante has moved away from its proposed fixed 7-day retention period (in its original guidelines) towards a more balanced approach. Indeed, whilst the Garante suggests a 21-day retention period as a โguidelineโ, it nonetheless permits employers to retain email metadata for longer periods - without an express limit - in the interests of security, provided this longer period is proportionate. For instance, it states that โpurposes related to IT security and the protection of IT assets justify the conservation of metadata for a period of time appropriate to the objective of detecting and mitigating any security incidentsโ.
The Garante further clarifies that โno new obligations or responsibilitiesโ arise from its current guidelines, meaning that employers and their service providers can remain fully focused on compliance with their existing obligations under GDPR (whilst taking the guidelines into account).
Major cybersecurity incidents experienced by another email and collaboration provider have reinforced that email logs are indispensable in reconstructing the sequence of events during those kinds of incidents. Indeed, in its assessment of these incidents, the U.S. Cyber Safety Review Board specifically recommends that cloud providers should retain logs for at least six months to ensure this reconstruction is possible. We believe this kind of retention period is fully aligned with the security-related objectives outlined by the Garante: reducing the retention period to a matter of days would be very likely to significantly impair an organisationโs ability to conduct thorough forensic investigations, identify the root cause of incidents, and implement effective remediation measures. Administrators often do not become aware of incidents occurring within their own organisation until well after many days from the incident date and, therefore, access to historical email metadata can be pivotal in minimizing the impact of security breaches and safeguarding sensitive information. For that reason, we believe it is crucial for customers - at their choice - to be able to access Gmail log events extending back 6 months.
LinkedIn
Twitter
