How long can an ISP retain my browsing data and logs in their server (in EU)? Can they sell these data to third parties like journalists, activists or big companies to make money on it?

Are they (they = the ISPs, obv) obligated by any law or rule to cancel the data they stored about me and my browsing activities/internet use/logs after a specific amount of time or certain conditions?

***I'm referring about EU (European Union) laws.*** Or does it depends on the specific country member of EU?

Plus: There is out there any document, articles or similar which explains clearly how the user data is managed by an ISP in European Union?

activists big big companies browsing companies data isp journalists logs money privacy server third third parties