Providers of public electronic communications services or networks must retain the data listed in regulation 20 (source, destination, date, time and duration, type, equipment and cell location, but never content) for six months (internet access and e-mail) or one year (fixed, mobile and internet telephony), including unsuccessful call attempts; disclose it only to the Police or the Security Service for investigating, detecting or prosecuting serious crime, on a clear written request (oral if urgent, confirmed in writing), without undue delay and in intelligible form; conserve data under a Police conservation order for up to six further months (two years in total without a court order) or until criminal proceedings end; keep it to network-equivalent quality and security, accessible only to specially authorised staff and destroyed at the end of the period; and report annual statistics without personal data to the Commissioner. These provisions transposed the Data Retention Directive, which the Court of Justice declared invalid in 2014, and general retention obligations are contested under later case law; the regulations nonetheless remain in the consolidated text.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.