The European court of justice (ECJ) ruling that blanket state surveillance without proper privacy safeguards is unlawful is packed with post-Brexit irony – not least in that it involves Britain losing a case in Europe initially brought by its Brexit minister, David Davis. But it is important because it means the battle over digital rights in Britain is not yet over.

Theresa May’s new turbo-charged state surveillance law – the Investigatory Powers Act 2016, with its extensive powers to track the entire population’s web browsing history for two years and allowing industrial scale state hacking of phones and computers – will come into effect from the end of this month.

EU's highest court delivers blow to UK snooper's charter Read more

But the ruling from the ECJ – particularly if, as is likely, it is upheld by British court of appeal judges – will mean that the new law will now face a succession of legal challenges from privacy campaigners fortified by the ruling in their back pockets.

The ruling itself relates to a much more limited British law – the Data Retention and Investigatory Powers Act 2014, known as Dripa – which expires under a sunset clause at the end of this month. That law required the telecom companies to hold all their customers’ communications data – the who, when and where they contacted by phone, text or email – for 12 months so it could be accessed by the police, security services and other public bodies.

The ECJ ruling clarified, at the request of British court of appeal judges, that EU data retention laws say such blanket retention of personal confidential data is unlawful under the EU’s fundamental charter of rights and its directive on privacy and electronic communications.

The landmark ruling says the state can carry out mass surveillance programmes only if they are targeted and not implemented on a “general and indiscriminate” basis. Targeting should be done by reference to time, geographical area or named persons. The ruling also lays down that the communications data can only be used for the purposes of fighting serious crime and access should be authorised by a court except in the most urgent cases.

The ruling is enough to strike down Dripa, should the UK court of appeal accept this “clarification” from the EU’s highest judges, but it will be academic as Dripa will be repealed in 10 days anyway.

However, it does have serious implications for the new snooper’s charter, the Investigatory Powers Act 2016 that includes the data retention powers the EU court has declared to be unlawful without the proper safeguards and which comes into force from 1 January.

The new state surveillance law includes a major extension of powers, including vast databases recording every website visited by the entire population. These databases can be accessed not just by the police and security services but by dozens of other public authorities, and in the case of communications data, without the need for suspicion of criminality or prior sign-off from a judge or other independent official. They include the NHS, Department for Work and Pensions and the Gambling Commission.

The ruling means ministers can no longer be certain that the new snooper’s charter will survive any privacy legal challenges in the British courts. The ruling is unlikely to mean that the Investigatory Powers Act is struck down by British judges, but it may well require further amendment.

Brexit campaigners may claim the ruling is evidence that staying in the EU undermines the fight against terrorism. But the judgment clearly says that the state is within its rights to conduct targeted digital surveillance to fight terrorism and serious crime as long as there are proper judicial safeguards.

Those who say ministers should just ignore the Luxembourg court ruling because Britain will soon be out of the EU will also be disappointed. Whether Britain is in or out of Europe, British judges will still be using this privacy benchmark to hold British ministers and their laws to account.