eu court rules against mass surveillance: key implications for privacy rights