The directive requires internet and phone providers to retain traffic, location and other data needed to identify the user, but not the content of the communication.
It is designed to help national law-enforcement authorities fight organised crime and terrorism and was introduced in 2006 after bombings on public transport in Madrid and London.
“It entails a wide-ranging and particularly serious interference with the fundamental rights to respect for private life and to the protection of personal data,” the ECJ said.
The news follows a request by Austrian and Irish courts for the European Court of Justice to rule if the law was in line with the Charter of Fundamental Rights of the EU.
The European Commission has already proposed a revision of the law, and it is being debated by EU member states.
