27/07/2023, 22:38 18 CURIA - Documents 4. measures to ensure that access to the data processing facilities is restricted to persons who have been specially authorised by the party subject to the obligation; and 5. a requirement for at least two persons who have been specially authorised by the party subject to the obligation to be involved when the data are accessed.’ Paragraph 113e of the TKG reads as follows: ‘(1) A party that is subject to an obligation pursuant to Paragraph 113a(1) must ensure that all access, in particular the reading, copying, alteration, deletion and blocking of data retained pursuant to the retention obligation under Paragraph 113b(1), is logged for data protection control purposes. The following data must be logged: 1. the time of access; 2. the persons accessing the data; 3. the purpose and nature of the access. (2) The log data may not be used for purposes other than data protection control. (3) A party that is subject to an obligation pursuant to Paragraph 113a(1) must ensure that the log data are deleted after one year.’ 19 In order to ensure a particularly high level of security and quality of data, the Federal Network Agency for Electricity, Gas, Telecommunications, Post and Railways establishes, in accordance with Paragraph 113f(1) of the TKG, a set of requirements which, pursuant to Paragraph 113f(2) thereof, must be continuously assessed and adapted where appropriate. Paragraph 113g of the TKG requires that specific security measures be integrated into the security policy statement which must be presented by the party subject to the obligation. The StPO 20 The first sentence of Paragraph 100g(2) of the Strafprozessordnung (Code of Criminal Procedure; ‘the StPO’) is worded as follows: ‘Where there is prima facie evidence that someone has been the perpetrator of or an accessory to one of the particularly serious criminal offences referred to in the second sentence or, in those cases where an attempted offence is punishable, that someone has attempted to commit the offence in question and it is a particularly serious instance of the offence, the traffic data retained pursuant to Paragraph 113b of the [TKG] may be collected if the investigation of the facts or the determination of the whereabouts of the person under investigation would otherwise be significantly impeded or impracticable and the collection of the data is proportionate to the importance of the matter.’ 21 Paragraph 101a(1) of the StPO establishes that judicial authorisation is required for the collection of traffic data pursuant to Paragraph 100g thereof. Under Paragraph 101a(2) of the StPO, the grounds of the judicial decision must include essential considerations relating to the necessity and appropriateness of the measure in the particular case in question. Paragraph 101a(6) of the StPO lays down an obligation to inform the participants in the telecommunications concerned. The disputes in the main proceedings and the question referred for a preliminary ruling 22 SpaceNet and Telekom Deutschland provide publicly available internet access services in Germany. The latter also provides publicly available telephone services in Germany. 23 Those service providers brought proceedings before the Verwaltungsgericht Köln (Administrative Court, Cologne, Germany), challenging the obligation imposed on them by the combined provisions of Paragraph 113a(1) and Paragraph 113b of the TKG to retain traffic and location data relating to their customers’ telecommunications as from 1 July 2017. https://curia.europa.eu/juris/document/document_print.jsf;jsessionid=A4432EEFFE3535A201E714AE6441EE66?mode=DOC&pageIndex=1&docid=265881… 8/28