Processing of traffic data

(1) Persons under a duty pursuant to section 3(2), first sentence may process the following traffic data only insofar as this is necessary to establish and maintain telecommunications, for billing purposes, or to establish further connections:
1. the number or identifier of the connections or terminal equipment involved, personal authorisation identifiers, in the case of the use of customer cards also the card number, and in the case of mobile connections also location data,
2. the beginning and end of the respective connection by date and time and, insofar as the charges depend on it, the volume of data transmitted,
3. the telecommunications service used by the user,
4. the endpoints of leased lines, their beginning and end by date and time and, insofar as the charges depend on it, the volume of data transmitted, and
5. other traffic data necessary to establish and maintain telecommunications and for billing purposes. In all other respects, traffic data must be deleted without delay by persons under a duty pursuant to section 3(2), first sentence after the connection has ended. Any processing of traffic data going beyond the first sentence is impermissible. The duty to process traffic data under other statutory provisions remains unaffected.
(2) Traffic data relating to a specific subscriber under paragraph 1 may be used by the provider of the telecommunications service for the purpose of marketing telecommunications services, of tailoring telecommunications services to demand, or of providing value added services, to the extent and for the period necessary for that purpose, only where the end-user has consented to that use in accordance with Regulation (EU) 2016/679. The data of other end-users must be anonymised without delay. Use of traffic data by reference to the number dialled for the purposes named in the first sentence is permitted only where the end-user has been informed in accordance with Regulation (EU) 2016/679 and has consented. In doing so, the data of other end-users must be anonymised without delay. The end-user must further be informed that consent under the first and third sentences may be withdrawn at any time.