The EU's top court said on Tuesday that the bloc's data protection rules should prevent authorities from indiscriminately snooping on personal data of internet and phone users.

But, spying agencies may briefly hold on to bulk data for a limited time when an EU member state faces "a serious threat," the European Court of Justice (ECJ) said.

The court said that in cases involving suspected terror activities, data collection should be limited to individuals, and a quick review should be carried out by an independent administrative body to assess whether it is absolutely necessary.

"In urgent cases, the review must take place promptly," the Luxembourg-based court said.

The ECJ was ruling on whether laws in Britain, France and Belgium allowing spy agencies to indiscriminately collect user metadata are in line with EU privacy rules.

Read more: EU court overturns US data transfer agreement in Facebook privacy case

An advisor to the ECJ in January argued that the laws in the three nations breached the bloc's rules, which apply in any situation where obligations are imposed upon companies for national security reasons.

An initial case was brought by privacy campaign group Privacy International. It said that the acquisition, use, retention, disclosure, storage and deletion of bulk personal communications data by UK intelligence agencies was unlawful under EU law.

The UK Investigatory Powers Tribunal referred the case to the ECJ. Tuesday's hearing was a joint one, with two similar cases from France and another from Belgium.

Read more: Opinion: Europe must not trust US with data protection

kw/aw (AP, dpa)