Given the importance of traffic and location data for the investigation, detection, and prosecution of criminal offences, as demonstrated by research and the practical experience of several Member States, there is a need to ensure at European level that data that are generated or processed, in the course of the supply of communications services, by providers of publicly available electronic communications services or of a public communications network are retained for a certain period, subject to the conditions provided for in this Directive.

Without prejudice to the provisions adopted pursuant to Directive 95/46/EC and Directive 2002/58/EC, each Member State shall ensure that providers of publicly available electronic communications services or of a public communications network respect, as a minimum, the following data security principles with respect to data retained in accordance with this Directive:

1. By way of derogation from Articles 5, 6 and 9 of Directive 2002/58/EC, Member States shall adopt measures to ensure that the data specified in Article 5 of this Directive are retained in accordance with the provisions thereof, to the extent that those data are generated or processed by providers of publicly available electronic communications services or of a public communications network within their jurisdiction in the process of supplying the communications services concerned.

9. Measuring data retention in connection with the provision of publicly available electronic communications services or a public communications network[xliii] | Developing methods to include the statistics mentioned in the directive[xliv] in regular data collection activities and include these in the ESS | COM/JLS and Eurostat, JLS expert group and ESS | 2007 | Data collected and included in the Eurostat database subject to quality assessment |

3. Processing of location data other than traffic data in accordance with paragraphs 1 and 2 must be restricted to persons acting under the authority of the provider of the public communications network or publicly available communications service or of the third party providing the value added service, and must be restricted to what is necessary for the purposes of providing the value added service.

Personal data in SIS II must be processed in accordance with the specific provisions of the basic legal acts governing this system (Regulation (EC) No 1987/2006 and Council Decision 2007/533/JHA), which clarify the principles of Directive 95/46/EC and in accordance with Regulation (EC) No 45/2001, Council of Europe Convention 108 and the Police Recommendation.[14] SIS II will use s-TESTA, the Commission’s secure data communication network.[15] Once operational, this system will be applicable in all Member States, Switzerland, Liechtenstein, Norway and Iceland.[16] The Commission is required to send to the European Parliament and the Coun ...[+++]cil a biannual progress report on the development of SIS II and potential migration from the first-generation system.[17]