ECJ decides: Data retention violates EU law