The IECA Article 89 third para., states that telecommunications companies must, in the interests of criminal investigations and public safety, keep a minimum record of data on users' electronic communications traffic for six months.
The minimum registration must ensure that a telecommunications company can inform which of its customers was the user of a particular telephone number, IP address or username, as well as providing information on all connections made by the user, their dates, who was connected and the amount of data transfer to the respective user, as well as which phone number a particular customer had during a particular period.
A telecommunications company must ensure the safekeeping of the above-mentioned data and is not permitted to use, or hand over, said information to anyone other than the police or the prosecution in accordance with the provisions of IECA Article 92. The traffic data must be deleted after this time as it is no longer needed.
IECA Article 92 states that a telecommunications company is obliged to comply with the police's requests for assistance in the investigation of a criminal case, given that those requests are based on a court order or are authorized by law. Telecommunications companies must establish procedures for responding to requests for police access to users' personal information. The rules on how the police authorities can obtain such data can be found in the Code of Criminal Procedure (CCP), no. 88/2008. CCP Articles 80-82 are the provisions that the authorities use to obtain a court order for telephone tapping/interception and other comparable measures. In addition to this, the Director of Public Prosecution has published instructions no. RS: 12/2017 on how surveillance with an interception and other measures should be carried out (available in Icelandic).