Privacy rights advocacy groups brought the case and the outcome on Tuesday is likely to reverberate outside the EU as governments in the United States and China have ramped up surveillance tools in the name of national security.

The EU'S Court of Justice said that the general and indiscriminate retention of such data can only be allowed when governments face a "serious threat to national security".

In this kind of situation, the full access to phone and internet users' data should be limited to a period that is "strictly necessary", it said in a statement.

The ruling is the result of four cases in France, Belgium and Britain in which governments have called for the extension of surveillance tools for the protection of their citizens.

"Such an interference with fundamental rights must be accompanied by effective safeguards and be reviewed by a court or by an independent administrative authority," the court said.

The ruling "serves as a reminder that no government should be above the law", said Caroline Wilson Palow, legal director of Privacy International, one of the plaintiffs.

"Democratic societies must place limits and controls on the surveillance powers of our police and intelligence agencies."

The ruling by the EU's highest court also allowed the collection and retention of IP addresses within the same limits when it is "strictly necessary".

National courts should not take into account information collected by authorities that fail to follow the principles stated in the ruling, the EU court said.

However, the court left room for interpretation of the principles stated in its ruling, as it is up to EU member states to define what constitutes a "serious threat for national security".

Under the ruling, people seriously suspected of involvement in "terrorist activities" can be spied on and followed online in real-time.

Mass surveillance tools can be used beyond a set time limit if the threat persists.

The Luxembourg-based jurisdiction's decision comes at a crucial time for EU institutions, which are in the midst of preparing a new version of the e-privacy directive, which defines privacy rights with regards to electronic communications.

The new e-privacy regulation is set to complete the EU's data privacy legal apparatus alongside the General Data Protection Regulation (GDPR), adopted two years ago.

The court's decision also comes three months after a previous ruling that invalidated a transatlantic data transfer deal because of concerns about US surveillance.

Australian Associated Press