The European Union has ruled that the “general and and indiscriminate” collection of computer data by governments is only permitted when used to fight serious crime. The decision, handed down today by the European Court of Justice, directly challenges the UK’s recently passed surveillance legislation, which includes plans to retain every citizen’s mobile and desktop browser history for up to a year.

The court notes that the collection of such data means citizens feel they are under “constant surveillance” and allows governments to draw “very precise conclusions” about their private lives. “Only the objective of fighting serious crime is capable of justifying such interference,” said the court, adding that legislation like the UK’s “exceeds the limits of what is strictly necessary and cannot be considered to be justified within a democratic society.”

The ruling is clear, but Brexit gives the UK’s a get-out-of-jail-free card

It’s uncertain whether the ruling can or will be used to overturn the UK’s surveillance laws. The UK government will appeal the decision, and if that fails, Brexit itself gives it the chance to ignore the ruling. Whether or not the UK will have to abide by the court’s judgement will depend on the precise terms of its departure from the EU. The UK’s Home Office said it was “disappointed” with the decision, but that it will be “putting forward robust arguments to the court of appeal.”

Advocacy groups and opposition politicians welcomed the court’s judgement. Jim Killock, director of the UK’s Open Rights Group, described it as sending a “clear message” to the UK government that blanket surveillance is “intrusive and unacceptable in a democracy.” Tom Watson, deputy leader of the UK’s opposition Labour Party, and one of the individuals who brought the case to the EU, said the ruling shows it is “counter-productive to rush new laws through Parliament without a proper scrutiny."

“Most of us can accept that our privacy may occasionally be compromised in the interests of keeping us safe, but no one would consent to giving the police or the government the power to arbitrarily seize our phone records or emails to use as they see fit,” said Watson. “It’s for judges, not ministers, to oversee these powers.”