A man uses a mobile device. (PHOTO / BLOOMBERG)

British and French spies can only be handed access to the personal data of phone and internet users when there’s a “serious threat” to national security, the European Union’s top court ruled.

The EU Court of Justice said that EU law doesn’t allow nations to force internet and phone operators to carry out “the general and indiscriminate transmission or retention of traffic data and location data.”

A top EU court ruling in 2014 toppled rules requiring internet and phone companies to store swathes of customer data

“However in situations where a member state is facing a serious threat to national security that proves to be genuine and present or foreseeable, that member state may derogate from the obligation to ensure the confidentiality of data relating to electronic communications,” the court said in its ruling in Luxembourg on Tuesday.
READ MORE: FT: EU drafting rules to force big tech firms to share data

Privacy International and La Quadrature du Net, campaigners for citizens’ right to privacy, brought separate challenges in the UK and in France, arguing that the practices in the nations went too far and violated fundamental rights.

Tuesday’s ruling is the latest in a long line cases seeking to rein in the rights of authorities to keep tabs on citizens. A top EU court ruling in 2014 toppled rules requiring internet and phone companies to store swathes of customer data. Judges said this trampled on people’s privacy rights.

ALSO READ: Data points to stronger recovery

The 2014 case set the scene for years of challenges, including one in which EU judges ruled against the UK over its data retention plans. It also sparked concern in some countries, including in the UK, that the EU judges’ rulings deprive authorities of a crucial power to protect national security and fight terrorism.