The EBA may keep personal data in an identifiable form for a period of up to 10 years from the collection by the EBA and, where it does so, shall delete personal data upon expiry of that period. Based on a yearly assessment of their necessity, personal data may be deleted before the end of that maximum period on a case-by-case basis.