Data for information requests by security authorities

(1) A person providing number-based interpersonal telecommunications services, internet access services, or services consisting wholly or predominantly of the conveyance of signals, and, in doing so, assigning telephone numbers or other connection identifiers, or providing telecommunications connections for telephone numbers or other connection identifiers assigned by others, must, for the information procedures under sections 173 and 174, collect and store without delay, before activation, the following data, even insofar as these data are not necessary for operational purposes: 1. the telephone numbers, 2. other connection identifiers assigned by it, 3. the name and address of the connection holder, 4. for natural persons, their date of birth, 5. for fixed-network connections, the address of the connection, 6. in cases where mobile terminal equipment is also provided in addition to a mobile connection, the device number of that equipment, and 7. the date of assignment of the telephone number and, where different, the date the contract began. The date on which allocation of the telephone number ended and, where different, the date the contract ended, are also to be stored once known. The first and second sentences also apply where the data are not entered in end-user directories. For the information procedure under section 174, the form of data storage is not prescribed.
(2) Providers of prepaid mobile services must verify the accuracy of the data collected under subsection (1), first sentence, points 3 and 4, before activation, insofar as the data are contained in the documents submitted or the registers or directories inspected, by 1. presentation of an identity card within the meaning of section 2(1) of the Identity Card Act, 2. presentation of a passport within the meaning of section 1(2) of the Passport Act, 3. presentation of another valid official identity document that contains a photograph of the holder and with which the obligation to carry a passport or identity card within Germany is satisfied, which includes, in particular, a passport, identity card, or passport or identity card substitute recognised or permitted under provisions of the law on foreign nationals, 4. presentation of a residence title, 5. presentation of a certificate of arrival under section 63a(1) of the Asylum Act or a certificate of permission to reside under section 63(1) of the Asylum Act, 6. presentation of a certificate of suspension of deportation under section 60a(4) of the Residence Act, or 7. presentation of an extract from the commercial or cooperative register or a comparable official register or directory, the founding documents, or equivalent probative documents, or by inspecting these registers or directories and comparing them with the data contained therein, where the connection holder is a legal person or partnership. For this purpose, a distribution partner may, by way of derogation from section 20(2), second sentence, of the Identity Card Act and section 18(3), second sentence, of the Passport Act, send them an electronic copy of the identity card or passport. Verification may also be carried out by other suitable procedures; the Federal Network Agency determines, after hearing the circles concerned, which other procedures are suitable for verification, whereby a document within the meaning of the first sentence must in each case be used for the purpose of identification before activation of the contractually agreed mobile service. Obligated parties must, before using other suitable procedures, demonstrate the finding that a procedure conforms with the Federal Network Agency's determination, by a conformity assessment body within the meaning of the definition in Article 2, point 13, of Regulation (EC) No 765/2008 of the European Parliament and of the Council of 9 July 2008 setting out the requirements for accreditation and market surveillance relating to the marketing of products and repealing Regulation (EEC) No 339/93 (OJ L 218, 13.8.2008, p. 30), that has been accredited, in accordance with that Regulation, to carry out conformity assessment of other suitable procedures under the third sentence. The finding may not, at the time the procedure is used, be more than 24 months old. In the course of verification, the type of procedure used is to be stored; on verification by means of a document within the meaning of the first sentence, points 1 to 6, particulars of the type, number, and issuing body are additionally to be stored. For identification by means of an electronic proof of identity under section 18 of the Identity Card Act, under section 12 of the eID Card Act, or under section 78(5) of the Residence Act, section 8(2), fifth sentence, of the Anti-Money Laundering Act applies correspondingly.
(3) The obligation to store without delay under subsection (1), first sentence, applies correspondingly, in respect of the data under subsection (1), first sentence, points 1, 3, 4, and 7, to a person providing number-independent interpersonal telecommunications services and, in doing so, collecting data under subsection (1), first sentence, points 1, 3, 4, and 7, whereby the corresponding identifiers of the service replace the data under subsection (1), first sentence, point 1, and the user of the service replaces the connection holder under subsection (1), first sentence, point 3.
(4) Where the obligated party under subsections (1) to (3) becomes aware of a change, it must correct the data without delay.
(5) Where an obligated party under subsections (1) to (3) makes use of a third party to collect the data under subsection (1), first and second sentences, and subsection (3), or to verify the data under subsection (2), it remains responsible for fulfilling the obligations under subsections (1) to (3). The third party is prohibited from using or processing incorrect data. Where the third party becomes aware, in the course of the usual course of business, of changes to the data under subsection (1), first and second sentences, and subsection (3), it must transmit these to the provider of the telecommunications service without delay.
(6) The data under subsections (1) to (3) are to be deleted upon expiry of the calendar year following the end of the contractual relationship.
(7) No compensation is granted for the collection and storage of the data.