(Bloomberg) — Want the lowdown on European markets? In your inbox before the open, every day. Sign up here.

British and French spy and security agencies shouldn’t be given unfettered access to swathes of phone and internet users’ data, according to an adviser to the European Union’s top court who warned that mass interception of private communications is only allowed in a “limited and discriminate” manner.

A U.K. law that obliges telecommunications companies to provide security and intelligence agencies “with bulk communication data, which entails the prior general and indiscriminate collection of that data” is invalid under EU rules, Advocate General Manuel Campos Sanchez-Bordona of the EU Court of Justice said in a non-binding opinion on Wednesday.

A French law which, for reasons of “serious and persistent threats to national security, in particular the terrorist threat,” obliges such companies to retain all traffic and location data of their subscribers, is also invalid, the adviser said. The obligation under the French law is “general and indiscriminate and therefore is a particularly serious interference in the fundamental rights” of EU citizens.

The Luxembourg-based court’s rulings usually follow within months.

The top EU court in 2014 toppled the bloc’s rules requiring internet and phone companies to store swathes of customer data, saying this trampled on people’s privacy rights. The case set the scene for confusion and years of challenges since, including one in which EU judges ruled against the U.K. over its data retention plans.

The adviser said an obligation to retain data to combat crime and for national security reasons is allowed, but in a “limited and discriminate” manner. In cases of “an imminent threat or an extraordinary risk,” national rules could allow “for a limited period” the possibility to oblige companies “to retain data that is as extensive and general as is deemed necessary,” he said.

The latest cases stem from disputes in Belgium, France and the U.K., where advocacy group Privacy International sued to clarify whether the nation’s state intelligence agencies, including MI5, MI6 and GCHQ, had acted legally. Western governments have struggled to find a balance between protecting populations against the threat of terrorism and preserving their right to a private life.

The effect of the EU court’s eventual ruling in the U.K. case isn’t clear in light of Brexit. The U.K. is set to leave the EU on Jan. 31, but will remain subject to exiting EU laws and trade regulations during a transitional period lasting for the rest of the year.

If the final ruling goes against the U.K., it could ultimately mean the nation has to adapt its privacy protections to ensure they are deemed adequate by the EU.

The cases are: C-623/17 Privacy International, Joint Cases C-511/18 La Quadrature du Net e.a., C-512/18 French Data Network & Case C-520/18 Ordre des barreaux francophones et germanophone e.a.

To contact the reporter on this story: Stephanie Bodoni in Luxembourg at sbodoni@bloomberg.net

To contact the editors responsible for this story: Anthony Aarons at aaarons@bloomberg.net, Peter Chapman, Thomas Pfeiffer

For more articles like this, please visit us at bloomberg.com

©2020 Bloomberg L.P.