The UK may be forced to scale back its digital mass surveillance schemes after a court ruled today that its current powers are unlawful.

The UK’s Court of Appeal said that the Data Retention and Investigatory Powers Act (DRIPA) did not adequately restrict police officers access to personal information, including citizens’ phone records and web browsing history. According to a report from The Guardian, three appeal court judges ruled said that DRIPA lacked safeguards like an independent overseer, and so was “inconsistent with EU law.”