The European Union’s top court ruled on Tuesday that unrestrained mass surveillance of phone and Internet data is unlawful, in a move that could curb the powers of spying agencies in France and other EU countries.

Privacy rights advocacy groups brought the case and the outcome is likely to reverberate outside the EU as governments in the US and China have ramped up surveillance tools in the name of national security.

The EU’S Court of Justice said that the general and indiscriminate retention of such data can only be allowed when governments face a “serious threat to national security”.

In this kind of situation, the full access to phone and Internet users’ data should be limited to a period that is “strictly necessary”, it said in a statement.

The ruling is the result of four cases in France, Belgium and Britain in which governments have called for the extension of surveillance tools for the protection of their citizens.

“Such an interference with fundamental rights must be accompanied by effective safeguards and be reviewed by a court or by an independent administrative authority,” the court said.