Explicit recorded permission is required for the recording and retention of the personal history data or state data of any individual.
The Ownership Right to Personal Data
There are two types of personal data: credential data that validates your identity, and data about you, whether that is historical such as your educational record, your employment record or your health records. This also includes state data— data about you that is current—such as your location or you viewing a website or your context, such as driving a car or sitting in a cinema. A great deal of historical and state data is shared by virtue of the fact that you provide it to an application on a phone or other computing device. Because it is personal data, you own it completely and no organization has a right to it. Where an application is using it, you are giving permission for its use. This permission must be explicitly given rather than assumed, and there is no right to retain it beyond the span of time required for its use. Such rights must also be given explicitly and the use of the data and its term of retention defined explicitly.
Incidentally, this aligns with GDPR legislation in the EU, which goes into fine detail about such use of personal data and the individual’s rights over it. For more information visit the GDPR website.