On May 14, 2024, the French data protection authority (CNIL) published guidance on the provision of public internet access. In particular, CNIL highlighted that organizations providing public internet access are subject to legal obligations regarding the retention of traffic data, such as:

• the IP address allowing a device to be identified;
• the date, time, and duration of each connection; or
• data allowing the recipient of a communication to be identified.

CNIL provided that traffic data is personal data, and retention of it must accordingly be limited to data strictly necessary for processing. More specifically, data relating to the identity of the user, such as name, date and place of birth, address, email, and telephone number, must be kept for five years. Other information provided when creating an account must be kept for one year. Likewise, technical data, such as IP address, telephone number, and device ID, must be kept for one year. The following information may be kept for up to three months:

• data allowing the origin of the communication to be identified;
• technical characteristics, including the date, time, and duration of each communication;
• technical data allowing the identification of recipients of communications; and
• data relating to additional services requested or used and their suppliers.

Notably, CNIL clarified that users have the rights of access and rectification regarding the use of public internet, but that the above recommendations on retention periods do not apply to organizations' employees.

You can read the press release, only available in French, here.