Data Retention - Revision history

Astropoint at 08:07, 17 April 2026

2026-04-17T08:07:47Z

← Older revision		Revision as of 08:07, 17 April 2026
Line 23:		Line 23:
	The legislation does not specify a maximum number of years for data retention. This being the case, and following common industry practice, Bittylicious retains data for 5 years from the date of deletion.		The legislation does not specify a maximum number of years for data retention. This being the case, and following common industry practice, Bittylicious retains data for 5 years from the date of deletion.

	When the account is marked as deleted, we set a flag meaning the account can no longer be registered again. After 10 years, any sort of identifiable data, including uploaded data, will be automatically deleted.		When the account is marked as deleted, we set a flag meaning the account can no longer be registered again. After 5 years, any sort of identifiable data, including uploaded data, will be automatically deleted.

	==GDPR Article 17 Right To Erasure==		==GDPR Article 17 Right To Erasure==

Nicguana at 10:26, 7 March 2024

2024-03-07T10:26:39Z

← Older revision		Revision as of 10:26, 7 March 2024
Line 21:		Line 21:
	</blockquote>'''		</blockquote>'''

	The legislation does not specify a maximum number of years for data retention. This being the case, and following common industry practice, Bittylicious retains data for 10 years from the date of deletion.		The legislation does not specify a maximum number of years for data retention. This being the case, and following common industry practice, Bittylicious retains data for 5 years from the date of deletion.

	When the account is marked as deleted, we set a flag meaning the account can no longer be registered again. After 10 years, any sort of identifiable data, including uploaded data, will be automatically deleted.		When the account is marked as deleted, we set a flag meaning the account can no longer be registered again. After 10 years, any sort of identifiable data, including uploaded data, will be automatically deleted.
Line 31:		Line 31:
	In the case of Bittylicious, Isle of Man legislation is the only applicable law, namely the [https://www.gov.im/media/470621/anti-moneylaunderingandcounteringthefinancingofterrorismcode2015.pdf Anti-Money Laundering and Countering the Financing of Terrorism Code 2015], as described above.		In the case of Bittylicious, Isle of Man legislation is the only applicable law, namely the [https://www.gov.im/media/470621/anti-moneylaunderingandcounteringthefinancingofterrorismcode2015.pdf Anti-Money Laundering and Countering the Financing of Terrorism Code 2015], as described above.

	Bittylicious therefore not only has the right, but has an explicit duty under Isle of Man law, to retain these records for longer than companies which are not registered as a Designated Business might. It is unfortunate that the legislation does not explicitly set an upper limit of years for record retention. This being the case, Bittylicious follows common industry practice and retains records for 10 years, enabling it to comply fully with its anti-money laundering and counter-terrorism financing duties as a Designated Business.		Bittylicious therefore not only has the right, but has an explicit duty under Isle of Man law, to retain these records for longer than companies which are not registered as a Designated Business might. It is unfortunate that the legislation does not explicitly set an upper limit of years for record retention. This being the case, Bittylicious follows common industry practice and retains records for 5 years, enabling it to comply fully with its anti-money laundering and counter-terrorism financing duties as a Designated Business.

Nicguana at 17:04, 1 January 2021

2021-01-01T17:04:07Z

← Older revision		Revision as of 17:04, 1 January 2021
Line 1:		Line 1:
	==Regulation And UK Law==		==Data Protection, Regulation And Isle of Man Law==

	~~As of January 2020,~~ Bittylicious ~~Ltd~~ is ~~now~~ a ~~"relevant person" for~~ the ~~purposes~~ of ~~retaining~~ customer ~~records under the Money Laundering, Terrorist Financing and Transfer of Funds (Information on the Payer) Regulations 2017 (most recently amended end of 2019~~ to ~~include all UK cryptoasset~~ companies).		Bittylicious is registered as a Designated Business with the Isle of Man's Financial Services Authority. As such, it has certain responsibilities with regard to customer data retention which may not apply to companies operating in other industries.

	Here is the exact wording of the ~~The~~ Money Laundering~~, Terrorist~~ Financing ~~and Transfer~~ of ~~Funds (Information on the Payer) Regulations 2017 (or “MLR” for short)~~:		According to paragraph 33 of the [https://www.gov.im/media/470621/anti-moneylaunderingandcounteringthefinancingofterrorismcode2015.pdf Anti-Money Laundering and Countering the Financing of Terrorism Code 2015], Bittylicious is required to store user data for at least 5 years even after accounts are marked as deleted:
	<blockquote>'''~~PART 4 Reliance and~~ Record~~-keeping (40)~~
	* (1) ~~Subject to paragraph (5), a~~ relevant person must keep the records ~~specified in paragraph (2)~~ for at least the ~~period specified in~~ paragraph (3).		Here is the exact wording from the Anti-Money Laundering and Countering the Financing of Terrorism Code, paragraph 33:
	* (2) ~~The records are—~~
	** (a) a ~~copy~~ of ~~any documents and information obtained by the relevant person to satisfy the customer due diligence requirements in regulations 28, 29 and 33 to 37~~;		<blockquote>'''33 Record retention
	** (~~b) sufficient supporting records (consisting of the original documents or copies~~) in respect of ~~a transaction~~ (~~whether~~ or ~~not the transaction is an occasional transaction~~) ~~which is~~ the ~~subject of customer due diligence measures or ongoing monitoring~~ to ~~enable~~ the transaction ~~to be reconstructed~~.		*(1)A relevant person must keep the records required by this Code for at least 5 years
	* (3) ~~Subject to~~ paragraph (4), ~~the period is five years beginning on the date on which the relevant person knows, or has reasonable grounds to believe—~~		**(a)in the case of records required by paragraph 32(b), from the date of the completion of the transaction; and
	** (a) ~~that the transaction is complete, for records relating~~ to ~~an occasional transaction~~; or		**(b)in other cases, from the date when
	** (b) that ~~the business relationship has come to an end for records relating to—~~		***(i)all activities relating to anoccasional transactionor a series of linked transactions were completed; or
	***(i) any transaction which occurs as part of a ~~business relationship,~~ or		***(ii)in respect of other activities
	***(ii) ~~customer due diligence measures taken in connection with that relationship.~~		****(A)the business relationship was formally ended; or
	* (4) A relevant person is ~~not required to keep~~ the records ~~referred to in paragraph (3)(b)(i)~~ for ~~more than 10 years~~.		****(B)if the business relationship was not formally ended, when all activities relating to the transaction were completed.
			*(2)Without limiting sub-paragraph (1), if
			**(a)a report has been made to a constable under paragraphs26(1)(f)and 28;
			**(b)the relevant person knows or believes that a matter is under investigation by a competent authority; or
			**(c)the relevant person becomes aware that a request for information or an enquiry is underway by a competent authority,the relevant person must retain all relevant records for as long as required by the constable or competent authority as the case may be.
	</blockquote>'''		</blockquote>'''

	~~==Industry Standards And Liability==~~		The legislation does not specify a maximum number of years for data retention. This being the case, and following common industry practice, Bittylicious retains data for 10 years from the date of deletion.
	~~Companies covered by this piece~~ of ~~UK legislation interpret this section to mean that failure to retain records for up to 10~~ years ~~can result in civil and criminal liability~~ for ~~breach of~~ the ~~MLR~~, and ~~therefore retention of records for 10 years has become both the~~ industry ~~standard and the expectation of the UK courts when investigating financial crime.~~

	~~In reality~~, ~~though a company might be found not to be in breach~~ for ~~destroying records between 5 and~~ 10 years~~, they would have to argue this case in court, and risk losing their case as~~ the ~~legislation only explicitly protects them when they destroy records after 10 years, not 5~~.

	~~This risk of criminal and civil liability~~ is ~~too great for other players in~~ the ~~industry (banks~~, ~~etc)~~, ~~and is similarly too great for Bittylicious~~, ~~now that all cryptoasset companies are obliged to comply with the same rules as other financial players (since January 2020)~~.		When the account is marked as deleted, we set a flag meaning the account can no longer be registered again. After 10 years, any sort of identifiable data, including uploaded data, will be automatically deleted.

	==GDPR Article 17 Right To Erasure==		==GDPR Article 17 Right To Erasure==

	The GDPR specifically allows for instances where Article 17 (right to erasure) conflicts with other ~~UK legislation, allowing for the other piece of UK~~ legislation ~~to take precedence~~, in ~~this case the MLR.~~		The Isle of Man is not a member of the European Union. Even though Isle of Man legislation specifically introduced the GDPR into law, the GDPR itself specifically allows for instances where Article 17 (right to erasure) conflicts with other legislation, even in member states.

	~~Article 17(3)(b) of the GDPR~~ states that the right to erasure does not apply where processing is necessary "for compliance with a legal obligation which requires processing by Union or Member State law to which the controller is subject".
	~~To be clear, this provision of the GDPR means that in this case, the MLR takes precedence over the GDPR with respect to the right to erasure under GDPR Article 17~~.

	~~This means that~~ Bittylicious ~~not~~ only ~~has the right, but has an ''explicit duty under UK~~ law~~'' to retain these records for longer than used to be the case~~, ~~before~~ the ~~cryptoasset industry was regulated~~ and ~~Bittylicious considered a "relevant person" under~~ the ~~MLR~~.		In the case of Bittylicious, Isle of Man legislation is the only applicable law, namely the [https://www.gov.im/media/470621/anti-moneylaunderingandcounteringthefinancingofterrorismcode2015.pdf Anti-Money Laundering and Countering the Financing of Terrorism Code 2015], as described above.

	~~Standard GDPR~~ right to ~~erasure rules changed~~ for ~~Bittylicious as soon~~ as ~~it became~~ a ~~"relevant person" for~~ the ~~purposes~~ of the ~~MLR~~, ~~along with all other UK cryptoasset companies, i.e. January 2020. This is why~~ Bittylicious ~~is now obliged to retain~~ records for 10 years.		Bittylicious therefore not only has the right, but has an explicit duty under Isle of Man law, to retain these records for longer than companies which are not registered as a Designated Business might. It is unfortunate that the legislation does not explicitly set an upper limit of years for record retention. This being the case, Bittylicious follows common industry practice and retains records for 10 years, enabling it to comply fully with its anti-money laundering and counter-terrorism financing duties as a Designated Business.

Nicguana: Created page with "==Regulation And UK Law== As of January 2020, Bittylicious Ltd is now a "relevant person" for the purposes of retaining customer records under the Money Laundering, Terror..."

2020-07-11T14:15:55Z

Created page with "==Regulation And UK Law== As of January 2020, Bittylicious Ltd is now a "relevant person" for the purposes of retaining customer records under the Money Laundering, Terror..."

New page

==Regulation And UK Law==

As of January 2020, Bittylicious Ltd is now a "relevant person" for the purposes of retaining customer records under the Money Laundering, Terrorist Financing and Transfer of Funds (Information on the Payer) Regulations 2017 (most recently amended end of 2019 to include all UK cryptoasset companies).

Here is the exact wording of the The Money Laundering, Terrorist Financing and Transfer of Funds (Information on the Payer) Regulations 2017 (or “MLR” for short):
<blockquote>'''PART 4 Reliance and Record-keeping (40)
* (1) Subject to paragraph (5), a relevant person must keep the records specified in paragraph (2) for at least the period specified in paragraph (3).
* (2) The records are—
** (a) a copy of any documents and information obtained by the relevant person to satisfy the customer due diligence requirements in regulations 28, 29 and 33 to 37;
** (b) sufficient supporting records (consisting of the original documents or copies) in respect of a transaction (whether or not the transaction is an occasional transaction) which is the subject of customer due diligence measures or ongoing monitoring to enable the transaction to be reconstructed.
* (3) Subject to paragraph (4), the period is five years beginning on the date on which the relevant person knows, or has reasonable grounds to believe—
** (a) that the transaction is complete, for records relating to an occasional transaction; or
** (b) that the business relationship has come to an end for records relating to—
***(i) any transaction which occurs as part of a business relationship, or
***(ii) customer due diligence measures taken in connection with that relationship.
* (4) A relevant person is not required to keep the records referred to in paragraph (3)(b)(i) for more than 10 years.
</blockquote>'''

==Industry Standards And Liability==
Companies covered by this piece of UK legislation interpret this section to mean that failure to retain records for up to 10 years can result in civil and criminal liability for breach of the MLR, and therefore retention of records for 10 years has become both the industry standard and the expectation of the UK courts when investigating financial crime.

In reality, though a company might be found not to be in breach for destroying records between 5 and 10 years, they would have to argue this case in court, and risk losing their case as the legislation only explicitly protects them when they destroy records after 10 years, not 5.

This risk of criminal and civil liability is too great for other players in the industry (banks, etc), and is similarly too great for Bittylicious, now that all cryptoasset companies are obliged to comply with the same rules as other financial players (since January 2020).

==GDPR Article 17 Right To Erasure==

The GDPR specifically allows for instances where Article 17 (right to erasure) conflicts with other UK legislation, allowing for the other piece of UK legislation to take precedence, in this case the MLR.

Article 17(3)(b) of the GDPR states that the right to erasure does not apply where processing is necessary "for compliance with a legal obligation which requires processing by Union or Member State law to which the controller is subject".
To be clear, this provision of the GDPR means that in this case, the MLR takes precedence over the GDPR with respect to the right to erasure under GDPR Article 17.

This means that Bittylicious not only has the right, but has an ''explicit duty under UK law'' to retain these records for longer than used to be the case, before the cryptoasset industry was regulated and Bittylicious considered a "relevant person" under the MLR.

Standard GDPR right to erasure rules changed for Bittylicious as soon as it became a "relevant person" for the purposes of the MLR, along with all other UK cryptoasset companies, i.e. January 2020. This is why Bittylicious is now obliged to retain records for 10 years.

Data Retention - Revision history

Astropoint at 08:07, 17 April 2026

Nicguana at 10:26, 7 March 2024

Nicguana at 17:04, 1 January 2021

Nicguana: Created page with "==Regulation And UK Law== As of January 2020, Bittylicious Ltd is now a "relevant person" for the purposes of retaining customer records under the﻿ Money Laundering, Terror..."

Nicguana: Created page with "==Regulation And UK Law== As of January 2020, Bittylicious Ltd is now a "relevant person" for the purposes of retaining customer records under the Money Laundering, Terror..."