The requirement to collect and store individual participant data is laid down in Art. 125(2)(d) of the CPR (Regulation (EU) No 1303/2013) dealing with functions of the managing authority. Member States should adapt their systems, if needed, in order to comply with it. In addition, the annexes to the ESF Regulation (Regulation (EU) No 1304/2013) state clearly that the data processing arrangements put in place by Member States must be in line with the provisions of Directive 95/46 of 24 October 1995 on the protection of individuals with regard to the processing of personal data, in particular Articles 7 and 8 thereof.
Further to Art. 6(1)(e) of the above mentioned directive, the personal data must be "kept in a form which permits identification of data subjects for no longer than is necessary for the purposes for which the data were collected or for which they are further processed". The purposes are set out in the above mentioned articles and annexes of the CPR and the ESF Regulation. In addition, the duration of data retention is also influenced by the evaluations conducted by the Member States and the Commission. For example, impact evaluations often use counterfactual methods with control or comparison groups, which require information on the situation of the participants throughout the implementation period. To this end, data on individual participants are needed