Regulation 8 Retention of data

(1)

Where a report has been sent to the NCA in accordance with regulation 6(1), the provider must retain—

(a)

for a period of five years from the date of issue, the unique report reference number (which appears on the automated receipt), and

(b)

for a period of one year—

(i)

the detected CSEA content,

(ii)

the information submitted in accordance with these Regulations,

(iii)

any information which has been used to make a judgement that the content is CSEA content, and

(iv)

any relevant data associated with the user who uploaded, created, shared or received the CSEA content,

beginning with the date on which the report was sent.

(2)

For the purposes of paragraph 1(b)(iv), relevant data is any of the following data from the two-week period prior to the CSEA content being uploaded, created, shared or received—

(a)

any digital files with content which the user has uploaded, created, shared or received on the internet service,

(b)

any digital files with metadata or communications data associated with the CSEA content,

(c)

any digital files with geolocation data in addition to that included in the metadata,

(d)

any digital files with chat logs, public and private messages, and public comments created by the user, and

(e)

any digital files with information about connections with other accounts (including attempted connections).