BRUSSELS (AP) — The European Union’s highest court said Tuesday that the bloc’s data protection rules should prevent authorities from indiscriminately snooping on the personal data of internet and phone users, even for national security purposes.

However, spying agencies may briefly hold on to bulk electronic data for a limited time when a EU member state faces “a serious threat,” the European Court of Justice said.

The ECJ ruled on a series of linked cases from France, the U.K. and Belgium, three countries that have been hit by extremist attacks in recent years and have reinforced surveillance.

The court said that, despite diverging claims from several member states, national legislation “falls within the scope” of the European directive on privacy and electronic communications.

Highlighting the obligation for member states to ensure the confidentiality of data relating to electronic communications, the court said that in cases where terror activities are suspected, collection of data should be limited to individuals, and a quick review should be carried out by an independent administrative body assessing whether it’s absolutely necessary.

“In urgent cases, the review must take place promptly,” the ECJ said.

The initial case was brought by Privacy International, a privacy campaign group. Referring to the ECJ’s case law, it said that the acquisition, use, retention, disclosure, storage and deletion of bulk personal data sets and bulk communications data by the U.K. security and intelligence agencies was unlawful under EU law.

The U.K.’s Investigatory Powers Tribunal referred the case to the ECJ, which held a joint hearing with two similar cases from France and another one from Belgium.

Although Britain left the EU in January, the court continues to have jurisdiction over matters affecting the U.K. during the Brexit transition period ending Dec. 31.

“Today’s judgment reinforces the rule of law in the EU," said Privacy International legal director Caroline Wilson Palow. “In these turbulent times, it serves as a reminder that no government should be above the law. Democratic societies must place limits and controls on the surveillance powers of our police and intelligence agencies."

Kelvin Chan in London contributed to this report.