The European Union's top court ruled on Tuesday that unrestrained mass surveillance of phone and internet data is unlawful, in a move which could curb the powers of spying agencies in France and other EU countries.

Privacy rights advocacy groups brought the case and the outcome is likely to reverberate outside the EU as governments in the United States and China have ramped up surveillance tools in the name of national security.

In a much-awaited court ruling, the court said that the general and indiscriminate retention of such data can only be allowed when governments face a "serious threat to national security."

In this kind of situation, the full access to phone and internet users' data should be limited to a period that is "strictly necessary," it said.

Law enforcement agencies have long grappled with the balance between fighting terrorism and serious crime, and individuals' right to data privacy. The rulings come in a set of cases brought by privacy groups in Britain, France and Belgium.

"Such an interference with fundamental rights must be accompanied by effective safeguards and be reviewed by a court or by an independent administrative authority," the court said.

In January, an adviser to the European Court of Justice (ECJ) argued that the laws in the three countries breached EU rules, which apply in any situation where obligations are imposed on companies, including on the grounds of national security.

Advocate General Manuel Campos Sanchez-Bordona noted that the French, British and Belgian provisions require the general and indiscriminate retention of individuals' data, such as their location and who they are communicating with – although not the contents of their electronic exchanges.

In 2016, the ECJ had ruled in another case that the blanket collection and retention of communication data go against EU law.