"General and indiscriminate retention" of emails and electronic communications by governments is illegal, the European Court of Justice (ECJ) ruled this week.
Only targeted interception of traffic and location data in order to combat serious crime - including terrorism - is justified, according to a long-awaited decision by the ECJ in Luxembourg.
The UK government said it is "disappointed" with the judgment and plans to defend the new law robustly in the Court of Appeal.
The case will now return to the UK Court of Appeal to be resolved in terms of UK legislation. The aim of going to Luxembourg was to clarify EU law on surveillance.
More From This Section
As Britain is still a member of the EU until it officially triggers Brexit negotiations under Article 50 of the Lisbon Treaty, it is bound by the judgments of the ECJ.
The challenge was initially championed by David Davis, then a back bench Conservative party MP but now the Brexit Secretary in British Prime Minister Theresa May's Cabinet.
He had withdrawn from the case following his ministerial appointment.
The controversial "snooper's charter" requires communications companies to retain data for 12 months.
Lawyers for the UK government maintained that intercepted communications have been at the heart of every terrorist case investigated by police and the security services in recent years.