1. Introduction

Data retention for travel health data refers to the collection, storage, use and eventual deletion of personal health information gathered from travellers by governments, airlines, airports, immigration authorities, public health agencies, hospitals and digital travel-health platforms.

Such information may be collected for infectious-disease surveillance, vaccination verification, outbreak management, border screening or public health emergencies.

The central legal issue is this: How long may an organisation retain a traveller’s health data after the original travel or public-health purpose has ended?

A government may have legitimate reasons to retain health records temporarily to trace infectious contacts or investigate an outbreak. However, indefinite storage of identifiable medical information, travel histories or passenger health declarations can interfere with privacy, informational autonomy and freedom of movement.

The key legal principles are:

Purpose limitation: Data must be used for a defined, lawful purpose.

Storage limitation: Identifiable data should not be kept longer than necessary.

Necessity and proportionality: The duration and scope of retention must be justified by the objective pursued.

Data minimisation: Only the information needed for the stated purpose should be collected and retained.

Accountability: Organisations must be able to explain and justify their retention periods.

Secure deletion: Data should be erased or irreversibly anonymised when lawful retention is no longer necessary.

These principles are reflected in the European Union’s General Data Protection Regulation (GDPR) and India's data-protection framework.

C-77/21 Digi 20 Oct 2022+2

2. What constitutes travel health data?

Medical and diagnostic data

COVID-19 or other infectious-disease test results, symptoms, diagnoses and health declarations.

Vaccination and immunity records

Vaccination certificates, immunisation status and relevant medical exemptions.

Passenger and movement records

Passenger locator forms, flight itineraries, arrival dates, transit details and information identifying possible contacts.

Digital health credentials

QR-code verification records, app logs, access records and linked identity information.

Not every travel record is legally classified as health data. However, travel information linked to a person's diagnosis, test result or vaccination status may reveal sensitive medical information and therefore attract stronger legal safeguards.

3. Legal framework governing retention limitations

A. European Union — GDPR

The GDPR provides one of the clearest legal frameworks for limiting retention of identifiable travel health data.

Important provisions include:

Article 5(1)(b): Personal data must be collected for specified, explicit and legitimate purposes.

Article 5(1)(c): Data collection must be adequate, relevant and limited to what is necessary.

Article 5(1)(e): Personal data must be kept in identifiable form no longer than necessary for the purposes of processing.

Article 6: Processing requires a valid legal basis.

Article 9: Health data is a special category of personal data, subject to additional restrictions.

Articles 12–15: Transparency and data-subject access rights.

Article 17: Right to erasure, subject to exceptions.

Article 25: Data protection by design and by default.

Article 32: Appropriate security measures.

C-77/21 Digi 20 Oct 2022+1

A travel-health authority cannot ordinarily justify retaining every traveller's identifiable medical records indefinitely merely because a future outbreak is possible. It must establish an appropriate legal basis and a defensible reason for the retention period.

Some records may lawfully be retained longer where a statutory duty, public-health requirement, legal claim or other recognised exception applies. Those exceptions do not automatically justify keeping all data in its original identifiable form.

B. India — Digital Personal Data Protection Act, 2023

The Digital Personal Data Protection Act, 2023 (DPDP Act) establishes a framework for processing digital personal data, including identifiable digital health and travel information within its scope.

Relevant provisions include:

Section 4: Grounds for lawful processing.

Section 5: Notice requirements.

Section 6: Consent and related requirements.

Section 8(7): Erasure when consent is withdrawn or the specified purpose is no longer served, whichever is earlier, unless retention is necessary for compliance with law.

Section 8: General obligations of data fiduciaries, including security and accountability-related duties.

India Code+1

The Act's application depends on its commencement provisions, applicable rules, territorial scope and any relevant exemptions. It should not be assumed that every provision applies to every organisation or processing activity on the same date.

India's constitutional privacy protection is also relevant when public authorities collect or retain travel-related health information. The DPDP Act does not itself establish a universal, fixed number of days for retaining all travel health records.

C. International human-rights principles

The right to privacy under Article 17 of the International Covenant on Civil and Political Rights (ICCPR) is relevant to unjustified or arbitrary interference with private life.

Where retention is undertaken by public authorities, the legality, necessity and proportionality of the interference are important considerations. Restrictions may be justified for genuine public-health objectives, but their scope must be defensible.

In the European context, Articles 7 and 8 of the EU Charter of Fundamental Rights protect private life and personal data, while Article 52(1) governs the justification of limitations on Charter rights.

4. Leading case laws and judicial principles

The following judgments provide important guidance on retention limits, even where the cases concerned passenger travel records, general personal data or constitutional privacy rather than travel-health data specifically.

Case 1: Digi Távközlési és Szolgáltató Kft. v. Nemzeti Adatvédelmi és Információszabadság Hatóság (2022)

Case C-77/21 · Court of Justice of the European Union · Judgment of 20 October 2022

Legal issue: Whether personal data may continue to be retained or reused after the original purpose for collection has been fulfilled.

Decision: The Court explained that the GDPR's storage-limitation principle requires controllers to demonstrate that personal data remain necessary for their processing purposes. Data that were lawfully collected can become unlawfully retained as circumstances change.

Cour de justice de l’Union européenne+1

Application to travel health data: A database containing travellers' COVID-19 test results might initially be justified for contact tracing. Once the relevant tracing period has expired and no other lawful purpose supports retention, continuing to keep identifiable results may breach the storage-limitation principle.

Legal principle: Lawful collection does not confer an unlimited right to retain data.

Case 2: Ligue des droits humains ASBL v Conseil des ministres

Case C-817/19 · Grand Chamber, CJEU · 21 June 2022

Legal issue: Whether passenger name record (PNR) information could be retained for five years indiscriminately for all air passengers.

Decision: The Court held that a general five-year retention period could not be applied indiscriminately to all passengers. Continued retention after the initial six-month period required a more specific justification connected to objective evidence of a relevant risk. The judgment also imposed limits on the purposes for which PNR data could be processed.

Cour de justice de l’Union européenne+2

Application to travel health data: Although the judgment concerns passenger records used to combat serious crime and terrorism, its reasoning is highly relevant when assessing mass retention of health information linked to travel.

For example, retaining identifiable health declarations for every passenger for five years simply because some future outbreak might occur would require a specific legal justification and a proportionality assessment. A blanket retention policy should not be assumed lawful merely because the period is fixed in legislation.

Legal principle: Indiscriminate retention of all travellers' identifiable records may be disproportionate; longer retention may require individualised justification.

Case 3: K.S. Puttaswamy v. Union of India

Supreme Court of India · (2017) 10 SCC 1

Legal issue: Whether privacy is a constitutionally protected fundamental right in India.

Decision: A nine-judge bench unanimously recognised privacy as a fundamental right under the Indian Constitution, including protection of personal autonomy and informational privacy.

K.S. Puttaswamy Vs. Union o

Application to travel health data: A public authority collecting vaccination records, infection status or medical declarations should have a lawful basis and must respect applicable constitutional constraints.

A challenge to prolonged retention by a public authority could examine whether the measure has a legitimate objective, is authorised by law, is necessary and is proportionate to the privacy interference.

Legal principle: Public-health objectives do not automatically override the constitutional right to privacy.

Case 4: K.S. Puttaswamy (Aadhaar) v. Union of India (2018)

Supreme Court of India · (2019) 1 SCC 1

Legal issue: Whether the Aadhaar framework satisfied constitutional privacy requirements.

Decision: The Constitution Bench considered proportionality in assessing state measures affecting privacy. The framework includes a legitimate aim, suitability, necessity and balancing of benefits against the impact on rights.

Sci API+1

Application to travel health data: An Indian authority defending long-term storage of identifiable travel-health records should be able to explain:

The legitimate public-health purpose.

Why retaining the data contributes to that purpose.

Why a less intrusive alternative would not be equally effective.

Why the privacy impact is proportionate to the public benefit.

Legal principle: A public-interest justification should be supported by evidence and safeguards rather than a general assertion of necessity.

Case 5: Rijkeboer v. College van burgemeester en wethouders van Rotterdam

Case C-553/07 · CJEU · 7 May 2009

Legal issue: Access to information about the use and disclosure of personal data over time.

Decision and relevance: The judgment is relevant to the effective exercise of data-subject access rights and the relationship between access to historical processing information and retention rules. It is also cited in the Digi judgment in connection with erasure when the relevant purposes have been served.

C-77/21 Digi 20 Oct 2022+1

Application to travel health data: A traveller's ability to understand how health information was used or disclosed may depend on the retention of appropriate audit records. This does not mean that every underlying medical record must be retained indefinitely; audit information and substantive health records can have different retention requirements.

Legal principle: Retention decisions should account for individuals' rights while distinguishing records needed for accountability from data no longer needed for the original purpose.

5. What limitations should apply to retention periods?

There is no single universally applicable retention period for all travel-health information. The appropriate period depends on the legal basis, public-health objective, data category and applicable jurisdiction.

These are general compliance principles, not statutory deadlines. Specific laws may prescribe different minimum or maximum periods, and a valid legal hold may prevent routine deletion.

6. When does retention become legally problematic?

Retention becomes particularly vulnerable to challenge in the following situations.

1. Indefinite storage: An organisation has no deletion date, review process or documented justification.

2. Purpose expansion: Data originally collected for outbreak control are later used for immigration enforcement, commercial profiling, advertising or unrelated policing without a valid legal basis.

3. Blanket retention: Every traveller's health records are retained for years regardless of whether they are relevant to an ongoing public-health need.

4. Failure to reassess necessity: An emergency programme continues to retain identifiable data even after the emergency or contact-tracing purpose has ended.

5. Excessive duplication: Airlines, health platforms, border authorities and government departments all keep copies without a clear need.

6. Inadequate deletion: Information remains in backups, downstream processors or accessible analytics databases after the main record is deleted, contrary to the applicable obligations.

The precise legal consequence depends on the governing law, available exemptions, the nature of the data and the circumstances of retention.

7. Public-health emergencies and exceptions

A public-health emergency can justify collecting and retaining information that would not ordinarily be necessary. However, emergency powers do not automatically justify permanent retention.

A defensible emergency retention policy should specify:

The statutory or other lawful basis for processing.

The health risk the programme addresses.

The data fields necessary to address that risk.

A defined retention period or a review mechanism tied to the continuing need.

Access controls and restrictions on secondary use.

Deletion or anonymisation when identifiable data are no longer necessary.

Independent oversight and an avenue for complaints.

Where genuinely anonymised information can serve epidemiological research, it may be possible to retain aggregate statistics after deleting identifiable records. However, pseudonymised information is still personal data where an individual can be reidentified using additional information.

8. Cross-border travel and multi-country data retention

International travel creates additional legal complications because the same record may be held by an airline, a destination-country authority and a health service in another jurisdiction.

The key questions are:

Which country’s law governs each organisation's processing?

Is international transfer permitted under the applicable rules?

Does the destination country impose its own retention or deletion obligations?

Can one authority lawfully require another organisation to preserve records?

What happens when one country's retention requirement conflicts with another country's deletion requirement?

The GDPR's international-transfer framework, applicable public-health legislation and domestic data-protection laws may all be relevant. A contractual agreement between organisations cannot, by itself, override mandatory statutory obligations.

9. Practical compliance framework

A government agency, airline or travel-health platform can implement the following approach.

Step 1 — Classify the data

Separate medical results, travel identifiers, verification outcomes and audit logs.

Step 2 — Identify the legal basis

Document the statutory, public-health, contractual or consent-related basis applicable to each purpose.

Step 3 — Establish retention schedules

Define a period or review trigger for each record type, supported by operational evidence and applicable law.

Step 4 — Restrict access and reuse

Apply role-based access, logging, purpose restrictions and controls on transfers to third parties.

Step 5 — Delete or anonymise

Execute documented deletion procedures, including for processors and relevant copies, subject to lawful preservation duties.

Step 6 — Audit the policy

Review retention periods after emergencies, regulatory changes, security incidents and changes in processing purpose.

10. Remedies for unlawful retention

Depending on the applicable jurisdiction, an affected traveller may be able to:

Request access to their personal data and information about processing.

Seek erasure where the applicable legal conditions are met.

Object to or challenge certain processing activities.

Complain to a data-protection regulator or other competent authority.

Seek judicial review of a public authority's decision.

Claim compensation or other remedies where the governing law permits and the relevant requirements are satisfied.

Under the GDPR, these possibilities arise from several provisions, including Articles 15, 17, 77, 79 and 82, subject to their respective conditions and exceptions. In India, available remedies depend on the DPDP Act's applicable provisions, commencement and rules, as well as any relevant constitutional or other statutory route.

11. Conclusion

The legal foundation of travel-health-data retention is the principle that data may be retained only for a legally justified purpose and for no longer than that purpose, or another applicable lawful obligation, requires.

The Digi judgment establishes the importance of storage limitation; Ligue des droits humains demonstrates the risks of indiscriminate retention of passenger records; and Puttaswamy supplies the constitutional privacy and proportionality framework relevant in India.

Together, these authorities support a system in which retention periods are justified, reviewed and enforced, rather than left indefinite by default. They do not, however, establish one universal retention deadline for every travel-health record.

For a jurisdiction-specific legal analysis, the most useful next step would be to examine India's travel-health data retention rules and constitutional case law, or compare them with the GDPR and EU passenger-data judgments.