(6) The requirement under subsection (5) to inform
subscribers of particular security risks does not
discharge the service provider from the obligation
to take appropriate and immediate measures to
restore the normal security level of the service.
(7) Where the provision of a value added service
requires that traffic or location data are forwarded,
the service provider shall inform the subscribers or
users concerning the type of data required, the
purpose and duration of data processing, and as to
whether or not the data is to be forwarded to third
persons.
(8) Information and communications service
providers shall be authorized to process traffic or
location data only on the prior consent of the
subscribers or users to whom the data are related,
and only to the extent and for the duration as it is
necessary for the provision of value added
services.
(9) Users and subscribers have the right to
withdraw their consent referred to in subsection (8)
at any time.
Storage of traffic
data
141. (1) Traffic data relating to subscribers and
users processed and stored by an information and
communications service provider shall be erased
or made anonymous when it is no longer needed
for the purpose of the transmission of a
communication without prejudice to subsections (2)
and (9).
(2) Information and communications service pro
viders shall be authorized to process the following
data for subscribers and users for the purposes of
billing for calls, collecting the related charges and
for keeping the subscriber contracts up to date
(a) the telephone number or other identifier
of the subscriber terminal;
(b) the address of the subscriber and the type
of terminal equipment;
139