In Europe, the privacy laws state that data may not be stored longer than is necessary. The necessary retention duration can be the result of a number of factors. 
‌
‌An important one is that there may be legal requirements to store data. For example, tax laws in the Netherlands require that receipts of transactions are stored for 7 years after the transaction takes place, so that the tax office still has the opportunity to start an audit some years later. Similarly, schools and universities are legally required to keep a record of your graduation for as long as you live.
‌
‌European privacy law itself does not specify any specific retention periods. An organisation must decide for itself how long personal data is necessary for the purpose for which the organisation has collected it.

‌

Duration in the label can be read as "up to this amount"

‌It can be very difficult to determine how long an organisation stores data. For example, it's common that a company has to retain employment records for 5 years after an employee leaves the company. If all employees only work for one year, then it would be simple: the data would at most be stored for 6 years (1 + 5). But in reality this of course means that for some employees the data is stored 6 years, while for others it's much longer. In other words: it varies.
‌
‌The label deals with this by taking the longest possible length. So if some employees can work there for longer than 2 years, then data necessary for handling employment (name, addres, bank account) will be marked as "longer than 7 years".