I have been pondering this point, and while I think there is a strong argument under Article 6(1)(f) of the GDPR for collecting this data as a legitimate interest of the company, I am stuck wondering about the legal reasoning for retaining the data so long.

The GDPR requires data to be kept only as long as necessary to achieve the purpose(s) of its collection. So, keeping all this data throughout the year just to create data visualizations? Seems sus -- to me. And I'd be interested in hearing from a DPO on how they justify the retention.

The corporate push to produce personalized year-in-review data visualizations is entertaining, but it also normalizes the commercial surveillance practices happening on a minute-by-minute basis.

And yes, the year-in-reviews are primarily a form of advertising, but the advertising is calling consumers to act by becoming a customer and entering into the company’s particular data collection practices. Because, after all, more users equals more data; more data equals more data points; more data points equals more inferences — which, ultimately, may enable the company to predict more accurately how the user will act in the future.

But this begs the question: should we allow such a normalization to happen? Are we okay with companies blatantly and openly flaunting their data collection practices merely because they dress up the personalized results in bright colors and humorous quips?

Or, should we ignore the flashy adornments and call it what it is: commercial surveillance?