The European Union's highest court on Tuesday struck down the bloc's data-retention law, which requires Internet and phone providers to retain users' data for up to two years.

The ruling from the European Court of Justice deals a blow to law-enforcement authorities who say access to data on users' traffic and location is necessary to fight organized crime and terrorism across the 28-country bloc. It also creates uncertainty for providers that have been collecting and storing user data since the 2006 law was enacted.

The Luxembourg-based court said the data-retention law violates EU citizens' "fundamental rights to respect for private life and to the protection of personal data," because it doesn't sufficiently limit the instances in which authorities can access the collected information.

"The fact that data are retained and subsequently used without the subscriber or registered user being informed is likely to generate in the persons concerned a feeling that their private lives are the subject of constant surveillance," the court said in a statement.

Christopher Kuner, partner at law firm Wilson Sonsini Goodrich & Rosati in Brussels, said Tuesday's ruling creates uncertainty for telecommunications providers and law-enforcement authorities and puts pressure on EU legislators to quickly adopt a new version of the data-retention law.

"The question is what happens in the meantime. What happens with the data that has already been collected and ongoing requests" for access from national authorities, said Mr. Kuner. The ruling could also open the door to legal challenges against data collection in national courts, he added.

The court said that although in general collecting and holding personal data to fight crime was in line with EU law, the current legislation was too broad. It didn't set sufficient limits for what data should be retained, for how long and when it could be accessed by law-enforcement authorities, the judges said.

They also said that data has to be stored within the EU, to ensure that it is sufficiently protected.

The data collected, "taken as a whole, may provide very precise information on the private lives of the persons whose data are retained, such as the habits of everyday life, permanent or temporary places of residence, daily or other movements, activities carried out, social relationships and the social environments frequented," the court said.

Data-privacy advocates celebrated the ruling. "After eight years, this affront to the fundamental rights of European citizens has finally been declared illegal," said Joe McNamee, executive director of European Digital Rights, one of whose members initiated the challenge to the data-retention law.

Michele Cercone, a spokesman for the European Commission, the EU's executive arm, said it was too early to say what practical consequences the ruling would have for data retention in the EU. The commission will now study the ruling in detail to see what further legislative action it requires, he added.

(Published by The Wall Street Journal – April 8, 2014)