The European Court of Justice ruled Tuesday that “general and indiscriminate transmission or retention of traffic data and location data” is banned.

The court was ruling on proceedings brought before bodies in the UK, France and Belgium dealing with these privacy and data surveillance issues.

The court found that the directive on privacy and electronic communications  precludes “national legislation requiring providers of electronic communications services to carry out the general and indiscriminate transmission of traffic data and location data to the security and intelligence agencies for the purpose of safeguarding national security.”

The directive also precludes “legislative measures requiring providers of electronic communications services [and providers of access to online public communication services and hosting service providers] to carry out the general and indiscriminate retention of traffic data and location data as a preventive measure,” as these retention measures are in serious “interference” with fundamental rights guaranteed by the EU Charter.

However, where a member state is facing is a genuine and serious threat to national security, the directive does not “preclude recourse to an order requiring providers of electronic communications services to retain, generally and indiscriminately, traffic data and location data.” Provided that such an order is limited in time, is strictly necessary and is “subject to effective review either by a court or by an independent administrative body.” Strict exceptions are also made for targeted data collection on individuals believed to be involved in terrorist activities.

Finally, the court held that the directive “requires national criminal courts to disregard information and evidence obtained by means of the general and indiscriminate retention of traffic and location data in breach of EU law.”