The Court of Justice of the EU (ECJ) has ruled member states cannot indiscriminately retain mass phone data to prevent crime.

Data collection has become a major source of contention between privacy advocates and governments, especially since Edward Snowden blew the whistle on the mass collection of data by various government agencies. The EU is now making that kind of data collection a little bit harder, according to Reuters, in an appeal over a case in Ireland.

The case in question involved a man who received life imprisonment for murder, but appealed based on the data collection that was used to prosecute him. While the ECJ said a national court would have to decide on the legality of the data’s use, it issued a broader statement about data collection, saying member states cannot use “general and indiscriminate” data retention as a way of preventing crime.

The court did leave the door open for very narrow circumstances where such action could be taken, but it would generally involve the most serious of crimes, such as those involving national security.