Exactly as I commented too. This ruling could basically make mass surveillance legal in the whole of EU and UK as long as the states set some unspecified limits themselves on how long they keep the data.
And some member states never really ruled on the matter clearly.
Now it's pretty clear and I have to agree and re-reading this ruling entirely that this is in fact making mass surveillance legal under an apparent cover of limiting it. Making your initial ending remark completely true.
What makes you think it's not already legal?