Shopkeepers may ask customers for their name and address for invoicing purposes, for instance, or to inform them about their commercial activities. In principle they have no reason, however, to ask for their date of birth or profession.
Once the personal data have been collected, limited data retention is to be considered.
Controllers must not keep the data any longer than necessary to achieve their purpose. Afterwards they therefore have to erase the data. The Privacy Act does not establish a retention period because it is impossible to do so for any imaginable processing operation. A number of specific acts do determine a concrete period, as does the Camera Act, for instance: surveillance camera footage may in principle only be retained for 1 month.