Network Functions Virtualisation (NFV); NFV Security; Report on Retained Data problem statement and requirements

The present document is designed to support Retained Data functionality. For the present document, "Retained Data functionality" is defined as situations in which CSPs, or their equivalent in NFV provisioning architectures, are performing the following tasks:

1. store data (either in their existing business stores, or in dedicated stores of data); and
2. at a later point, when presented with an appropriate request, make available the data that meets the request to the appropriate authority.

The present document is not a legal document. It does not define when or whether these tasks should take place, nor does it define what counts as an appropriate request or appropriate authority. The definition of what is or is not a "Communications Service Provider" (from the point of view of Retained Data) is out of scope. It is a pre-requisite to the present document that Retained Data functionality is in line with appropriate and relevant legislation on privacy and data protection.
 
The term "Data" in the present document is used to describe information which is collected, stored or queried as part of Retained Data functionality.
 
NOTE: In some jurisdictions, Retained Data may include "customer or subscriber data" (i.e. records with information about the customer (e.g. name, address) and their subscription) and "usage data" (i.e. records describing how the service was used). This note is included for background information but is not a definition.