EU governments cannot hold indiscriminately personal data unless there is a serious threat to national security, Europe's top court said on Tuesday, dealing a setback to EU countries banking on mass data retention laws to combat crime and safeguard national security.