I understand that.
For the legislation, in your example, it does not automatically provide that the provider—Apple, in this instance—would have to keep data. They would have to be designated either as a core provider or through a ministerial order. That process would need to happen before any obligations were imposed on them.
