The ECJ has specified the requirements for permissible data retention. Separate storage of IP addresses may be permissible if access is strictly regulated.