company for having kept for a period of one to six years the identity documents communicated to it by the persons concerned in the context of the exercise of a right. He considers that this period is excessive, as the data is kept beyond the time necessary to achieve the purpose for which it is processed.

On the failure to comply with the obligation to keep personal data for no longer than is necessary for the purposes for which it is processed