[Cantbekhan]

Link to ruling : http://curia.europa.eu/juris/document/document.jsf;jsessioni...

And from what I read the summary is wrong.

This ruling applies to all EU+UK (including post Brexit for now) states but was requested by UK/France/Belgium lawyers initially.

This ruling also seems to mandate that all EU+UK states cannot keep metadata indefinitely/permanently unless it's highly targeted (as in "individually targeted"), within a judicial framework and only for specific high security issues.

So it doesn't forbid mass surveillance per se but only seems to mandate that they can't keep the data forever unless strictly necessary.

Some could even interpret this ruling as permission to do mass surveillance as long as they don't keep the data for too long (a year? 10 years? it's unclear)