Europe’s top court ruled on Tuesday that EU governments cannot store indiscriminately personal data unless there is a substantial threat to national security, handing a blow to EU countries relying on mass data retention rules to combat crime and protect national security.

The decision by the European Union’s Court of Justice (CJEU) comes following major assaults by Islamist militants in France, Belgium, and the United Kingdom in recent years.

Governments argue that access to data, especially that collected by telecoms operators, can help prevent such incidents, while operators and civil rights activists oppose such access.

The latest case was triggered after Deutsche Telekom unit Telekom Deutschland and internet service provider SpaceNet AG which challenged Germany’s data retention law arguing it breached EU rules.

The German court subsequently sought the advice of the CJEU which said such data retention can only be allowed under very strict conditions.

“The Court of Justice confirms that EU law precludes the general and indiscriminate retention of traffic and location data, except in the case of a serious threat to national security,” the judges said.

“However, in order to combat serious crime, the member states may, in strict compliance with the principle of proportionality, provide for, inter alia, the targeted or expedited retention of such data and the general and indiscriminate retention of IP addresses,” they said.

According to eco – Association of the Internet Industry, which backs SpaceNet, Germany’s blanket data storage requirement costs the industry millions of euros.