03/02/2020 CURIA - Documents the user ID or telephone number of the intended recipient(s) of an Internet telephony call; the name(s) and address(es) of the subscriber(s) or registered user(s) and user ID of the intended recipient of the communication; data necessary to identify the date, time and duration of a communication: concerning fixed network telephony and mobile telephony, the date and time of the start and end of the communication; concerning Internet access, Internet e-mail and Internet telephony: the date and time of the log-in and log-off of the Internet access service, based on a certain time zone, together with the IP address, whether dynamic or static, allocated by the Internet access service provider to a communication, and the user ID of the subscriber or registered user; the date and time of the log-in and log-off of the Internet e-mail service or Internet telephony service, based on a certain time zone; data necessary to identify the type of communication: concerning fixed network telephony and mobile telephony: the telephone service used; concerning Internet e-mail and Internet telephony: the Internet service used; data necessary to identify users’ communication equipment or what purports to be their equipment: concerning fixed network telephony, the calling and called telephone numbers; concerning mobile telephony: the calling and called telephone numbers; the International Mobile Subscriber Identity (IMSI) of the calling party; e International Mobile Equipment Identity (IMEI) of the calling party; the IMSI of the called party; the IMEI of the called party; in the case of pre-paid anonymous services, the date and time of the initial activation of the service and the location label (Cell ID) from which the service was activated; concerning Internet access, Internet e-mail and Internet telephony: the calling telephone number for dial-up access; the digital subscriber line (DSL) or other end point of the originator of the communication; data necessary to identify the location of mobile communication equipment: the location label (Cell ID) at the start of the communication; data identifying the geographic location of cells by reference to their location labels (Cell ID) during the period for which communications data are retained. 2. No data revealing the content of the communication may be retained pursuant to this Directive. Article 6 Periods of retention Member States shall ensure that the categories of data specified in Article 5 are retained for periods of not less than six months and not more than two years from the date of the communication. Article 7 Data protection and data security Without prejudice to the provisions adopted pursuant to Directive 95/46/EC and Directive 2002/58/EC, each Member State shall ensure that providers of publicly available electronic communications services or of a public communications network respect, as a minimum, the following data security principles with respect to data retained in accordance with this Directive: the retained data shall be of the same quality and subject to the same security and protection as those data on the network; the data shall be subject to appropriate technical and organisational measures to protect the data against accidental or unlawful destruction, accidental loss or alteration, or unauthorised or unlawful storage, processing, access or disclosure; the data shall be subject to appropriate technical and organisational measures to ensure that they can be accessed by specially authorised personnel only; and the data, except those that have been accessed and preserved, shall be destroyed at the end of the period of retention. Article 8 Storage requirements for retained data Member States shall ensure that the data specified in Article 5 are retained in accordance with this Directive in such a way that the data retained and any other necessary information relating to such data can be transmitted upon request to the competent authorities without undue delay. Article 9 Supervisory authority 1. Each Member State shall designate one or more public authorities to be responsible for monitoring the application within its territory of the provisions adopted by the Member States pursuant to Article 7 regarding the security of the stored data. Those authorities may be the same authorities as those referred to in Article 28 of Directive 95/46/EC. 2. The authorities referred to in paragraph 1 shall act with complete independence in carrying out the monitoring referred to in that paragraph. … Article 11 Amendment of Directive 2002/58/EC curia.europa.eu/juris/document/document.jsf?doclang=EN&text=&pageIndex=0&part=1&mode=DOC&docid=150642&occ=first&dir=&cid=99319 (judgment… 5/11