The Court of Justice of the European Union (CJEU) has ruled in cases C-511/18 La Quadrature du Net, C-512/18 French Data Network, C-520/18 Ordre des barreaux francophones et germanophone, and C-623/17 Privacy International that national legislation of EU member states may not require a provider of electronic communications services to carry out the general and indiscriminate transmission or retention of traffic data and location data for the purpose of combating crime in general or safeguarding national security. 

The CJEU allowed for an exception in cases of serious threats to national security to an EU member state, under conditions of limiting the data retention to strictly necessary extent and time. In this case, effective safeguards must be in place for review by court or independent authority. 

The CJEU upheld the fundamental rights to privacy, freedom of expression, and personal data protection; where the limitation of these rights may take place only as targeted retention, limited in time to what is strictly necessary, limited in scope on the basis of objective and non-discriminatory factors.

This judgement, in joint cases, states that the national legislations requiring indiscriminate collection of data in criminal cases or for the purposes of national security are in violation of EU law. Specifically, this affects parts of the UK's Investigatory Powers Act (Privacy International case), the French Decree on specialised intelligence services from 2015 (La Quadrature du Net and others case), and the Belgian Law on collection and retention of communication data from 2016.

According to the Financial Times, the ruling will have an effect on the UK negotiations on the adequacy decision by the EU.