1. The EPPO shall review periodically the need for the storage of the operational personal data processed. At the latest, such a review shall be carried out not later than 3 years after the operational personal data were first processed and then every 3 years. If operational personal data are stored for a period exceeding 5 years, the European Data Protection Supervisor shall be informed of that fact.
5. No personal data, be it administrative or operational, shall be kept longer than necessary for the purpose for which it has been processed, or than required due to other legal obligations.
2. Operational personal data processed by the EPPO shall not be stored beyond 5 years after an acquitting decision in respect of the case has become final; in case the accused was found guilty the time limits shall be extended until the penalty that has been imposed, is enforced or can no longer be enforced under the law of the sentencing Member State.
3. Before one of the deadlines referred to in paragraph 2 expires, the EPPO shall review the need for the continued storage of the operational personal data where and as long this is necessary to perform its tasks. The reasons for the continued storage shall be justified and recorded. If no decision is taken on the continued storage of operational personal data, those data shall be deleted automatically.