Yes, they are required by law. Every country laws are different pertaining to the length of time that and ISP, can retain the data. (This is how Federal Agencies catch people who commit crimes, they obtain a court order for a warrant issued to your ISP, to release all of the data on you.
Mind Doctor, France