The European Union’s top court has severely undermined the British government’s mass surveillance powers in a new ruling that could rein in police and spy agency investigations.

In a judgment handed down in Luxembourg on Wednesday, the European Court of Justice declared that the “general and indiscriminate retention” of data about people’s communications and locations was inconsistent with privacy rights. The court stated that the “highly invasive” bulk storage of private data “exceeds the limits of what is strictly necessary and cannot be considered to be justified, within a democratic society.”

Camilla Graham Wood, legal officer with the London-based group Privacy International, hailed the ruling as a victory for civil liberties advocates. “Today’s judgment is a major blow against mass surveillance and an important day for privacy,” she said. “It makes clear that blanket and indiscriminate retention of our digital histories — who we interact with, when and how and where – can be a very intrusive form of surveillance that needs strict safeguards against abuse and mission creep.”

The European court’s panel of 15 judges acknowledged in their ruling that “modern investigative techniques” were necessary to combat organized crime and terrorism, but said that this cannot justify “the general and indiscriminate retention of all traffic and location data.” Instead, the judges stated, it is acceptable for governments to engage in the “targeted retention” of data in cases involving serious crime, permitting that persons affected by any surveillance are notified after investigations are completed, and that access to the data is overseen by a judicial authority or an independent administrative authority.

The case was originally brought in December 2014 by two British members of parliament, who challenged the legality of the U.K. government’s Data Retention and Investigatory Powers Act, which forced telecommunications companies to store records on their customers’ communication for 12 months. That law has since been replaced by the Investigatory Powers Act, which was recently approved by the British parliament and is expected soon to come into force.

Though the U.K. voted to leave the European Union earlier this year, Wednesday’s decision remains — at least in the short term — highly significant, and will prove to be a severe headache for British government officials. The ruling will now be forwarded to the U.K.’s Court of Appeal, where judges there will consider how to apply it in the context of national law. It may result in the government being forced to make changes to controversial sections of the Investigatory Powers Act, which enable police and spy agencies to access vast amounts of data on people’s internet browsing, instant messages, emails, phone calls, and social media conversations.

“This is the first serious post-referendum test for our government’s commitment to protecting human rights and the rule of law,” said Martha Spurrier, director of U.K. human rights group Liberty. “The U.K. may have voted to leave the EU — but we didn’t vote to abandon our rights and freedoms.” She added: “Today’s judgment upholds the rights of ordinary British people not to have their personal lives spied on without good reason or an independent warrant. The government must now make urgent changes to the Investigatory Powers Act to comply with this.”

A spokesperson for the British government’s Home Office said in a statement: “We are disappointed with the judgment from the European court of justice and will be considering its potential implications. The government will be putting forward robust arguments to the court of appeal about the strength of our existing regime for communications data retention and access.”

Top photo: The European Court of Justice.