EU member states cannot force internet companies to keep email data on a "general and indiscriminate" basis, the European Court of Justice has ruled.
The EU's highest court found that only targeted retention aimed at fighting serious crime could justify serious interference by the state.
Legislation which provided for the "general and indiscriminate" retention of data "exceeds the limits of what is strictly necessary and cannot be considered to be justified within a democratic society", it said.
The judgement, which was made in response to a complaint by deputy British Labour leader Tom Watson, could have major implications for the British government's controversial Investigatory Powers Act - labelled the "snooper's charter" by critics - which recently passed into law.
This requires communications companies to keep data for a year, something civil liberties campaigners say should be dropped in light of the ruling.
Communications data does not include the content of emails and telephone conversations, but the emails and phone numbers used and the times of the exchanges.
The case will now be sent back to the Court of Appeal in London.
Mr Watson's challenge was in relation to the Data Retention and Investigatory Powers Act (DRIPA) 2014, which was passed by the previous coalition government in the UK, which has been replaced by the Investigatory Powers Act.
A British Home Office spokesperson said the government was "disappointed" with the judgement.
"The Government will be putting forward robust arguments to the Court of Appeal about the strength of our existing regime for communications data retention and access," they said.
"Given the importance of communications data to preventing and detecting crime, we will ensure plans are in place so that the police and other public authorities can continue to acquire such data in a way that is consistent with EU law and our obligation to protect the public."
Mr Watson, whose challenge was originally backed by Conservative MP David Davis before he became Brexit Secretary, said the ruling "shows it's counter-productive to rush new laws through Parliament without proper scrutiny".
"At a time when we face a real and ever-present terrorist threat, the security forces may require access to personal information none of us would normally hand over," he said.
"That's why it's absolutely vital that proper safeguards are put in place to ensure this power is not abused, as it has been in the recent past.
"Most of us can accept that our privacy may occasionally be compromised in the interests of keeping us safe but no one would consent to giving the police or the Government the power to arbitrarily seize our phone records or emails to use as they see fit."
