Regulation (EU) 2017/1128 of the European Parliament and of the Council of 14 June 2017 on cross-border portability of online content services in the internal market

[...]

(30) This Regulation respects fundamental rights and observes the principles recognised in the Charter of Fundamental Rights of the European Union (‘Charter’). Accordingly, this Regulation should be interpreted and applied in accordance with those rights and principles, in particular the right to respect for private and family life, the right to protection of personal data, the right to freedom of expression, the freedom to conduct a business and the right to property, including intellectual property. Any processing of personal data under this Regulation should respect fundamental rights, including the right to respect for private and family life and the right to protection of personal data under Articles 7 and 8 of the Charter, and it is essential that such processing be in compliance with Directives 95/46/EC and 2002/58/EC. In particular, providers of online content services should ensure that any processing of personal data under this Regulation is necessary, reasonable and proportionate in order to achieve the relevant purpose. Where authentication of a subscriber is sufficient in order to provide the service, identification of the subscriber should not be required. Data collected pursuant to this Regulation for the purposes of verification of the Member State of residence should not be stored by the provider longer than necessary to complete such verification. Such data should be immediately and irreversibly destroyed after the verification is completed. However, this is without prejudice to the storage of data which was collected for another legitimate purpose, subject to applicable data protection rules, including rules concerning the storage of that data.

[...]