The European Court of Justice (CJEU) announced on Tuesday that legislation passed by all three countries that allows the government to demand traffic and location data from internet and mobile providers in “a general or indiscriminate way” breaks EU data privacy laws – even when national security concerns are invoked.
“The directive does not authorise the Member States to adopt, inter alia for the purposes of national security, legislative measures intended to restrict the scope of rights and obligations provided for in that directive, in particular the obligation to ensure the confidentiality of communications and traffic data, unless such measures comply with the general principles of EU law, including the principle of proportionality, and the fundamental rights guaranteed by the Charter,” the court decided.
In layman’s terms that means that a government can’t build a massive database of what everyone does and then query it later while investigating a case.
SOURCE: https://www.theregister.com/2020/10/07/eu_privacy_ruling/