In a nonbinding opinion at the European Court of Justice, an advocate general said that under the 2002 Privacy and Electronic Communications Directive, EU member states cannot require telecommunications companies to hand over bulk data to national security agencies.

If nations want to collect data on individuals, they must have permission from an independent authority, inform the person, and keep the data within the EU, the court adviser said.