EU member states cannot force telcos and internet firms to store collected data, the Court of Justice of the European Union said in its Dec. 21 published ruling.

The case stems from complaints by Tele2 Sweden against the Swedish Post and Telecom Authority, and from a group led by British lawmaker Tom Watson against the U.K. Secretary of State for the Home Department.

The CJEU said general and indiscriminate retention of data curtails users' right to privacy. The court, however, does not prohibit targeted retention of data for crime prevention purposes, provided that the data to be collected is limited to what is "strictly necessary."

Data retention is among the provisions in the controversial U.K. Investigatory Powers Bill, which the House of Commons approved in June.