The European Court of Justice (ECJ) on Tuesday ruled against the United Kingdom’s (U.K.’s) bulk data collection procedures. Privacy International had challenged both the U.K.’s claims of “national security” as “vague,” and the U.K.’s holding of bulk data for up to 14 years. The ECJ imposed restrictions and limitations: There needs to be a “serious threat to national security” and, in that case, the time period for keeping the collected data has to be “strictly necessary.” Previously the court had found that the EU-U.S. pact on EU user data was invalid, as U.S. national security laws did not properly shield Europeans.