The Data Retention (EC Directive) Regulations 2009

Data protection and data security

6.—(1) Public communications providers must observe the following principles with respect to data retained in accordance with these Regulations—

(a) the retained data must be of the same quality and subject to the same security and protection as those data on the public electronic communications network;

(b) the data must be subject to appropriate technical and organisational measures to protect the data against accidental or unlawful destruction, accidental loss or alteration, or unauthorised or unlawful storage, processing, access or disclosure;

(c) the data must be subject to appropriate technical and organisational measures to ensure that they can be accessed by specially authorised personnel only;

(d) except in the case of data lawfully accessed and preserved, the data retained solely in accordance with these Regulations must be destroyed at the end of the retention period.

(2) It is the duty of the Information Commissioner, as the Supervisory Authority designated for the purposes of Article 9 of the Data Retention Directive, to monitor the application of the provisions of these Regulations with respect to the security of stored data.

(3) As regards the destruction of data at the end of the retention period—

(a) the duty of a public communications provider is to delete the data in such a way as to make access to the data impossible; and

(b) it is sufficient for a public communications provider to make arrangements for the operation of so deleting data to take place at such monthly or shorter intervals as appear to the provider to be convenient.