A UK law requiring companies to keep up to a years worth of data on people's emails, phone calls and web activities is okay - as long as it "satisfies strict requirements" - according to a preliminary ruling from the European courts .
The legal case, which has implications for the future legislation on monitoring communications, was brought by Labour deputy leader Tom Watson and now chief Brexit minister David Davis.
The pair argued that parts of the Data Retention and Investigatory Powers Act (Dripa) of 2014 are illegal and do not respect people's right to privacy - and won a UK high court battle. The case went to the European Court of Justice after that result was contested by the UK government.
Now, the advocate general Henrik Saugmandsgaard has said the data retention part of the legislation may be compatible with EU laws, but it must be used to fight only serious crime, ahead of an official court ruling due within weeks.
"The advocate general is of the opinion that a general obligation to retain data may be compatible with EU law. The action by member states against the possibility of imposing such an obligation is, however, subject to satisfying strict requirements," a statement on the ruling said, concluding that "the general obligation to retain data must be proportionate".
Dripa legislation is due to run out this year and the so-called Snooper's Charter, or Investigatory Powers Bill, is awaiting approval in the House of Lords to replace it.
The IP bill has faced fierce criticism over its bulk collection of data by privacy campaigners, however, the government believes the surveillance powers will help it fight terrorism.
Liberty, the privacy group which worked on the case with Watson and Davis, believes the IP Bill will require significant amendment if the court supports today's initial finding.
“The IP Bill - the much-trumpeted legacy of our new Prime Minister’s time at the Home Office - goes much further than the law condemned today," said Liberty legal director James Welch.
"This 'Snooper's’ Charter’ will vastly expand blanket data-gathering powers, while failing to provide even the basic safeguards outlined by the advocate general. Dozens of public bodies will be able to grant themselves access to our most revealing personal data - including our web browsing histories - with no need for suspicion of criminality.”
Read more: Snooper-duper: Government win on new IP Bill
Watson said: "This legal opinion shows the Prime Minister was wrong to pass legislation when she was Home Secretary that allows the state to access huge amounts of personal data without evidence of criminality or wrongdoing"
"Labour has already secured important concessions but I hope the Government she leads will now revisit it. The opinion makes it clear that information including browsing history and phone data should not be made available to the security services and other state bodies without independent authorisation. The security services have an important job to do, but judicial oversight is vital if we are to maintain the right balance between civil liberties and state power."
That view was also echoed by legal experts.
""The most obvious potential issue for the IP bill is its suggestion that the government can only order data to be retained if the purpose for retention is restricted to serious crime – currently the IP bill allows authorities access to retained communications data for a variety of purposes, not just those linked to serious crime," said technology partner at law firm Bird & Bird, Graham Smith.
"The expansion of data retention into some areas may provide new grounds of legal challenge, whatever the decision of the court in this case. Those could include not only privacy and data protection issues, but also intrusion into freedom of expression."