Despite many of CJEU's rulings saying mass surveillance is banned in the EU, member states have been exploiting loopholes in them to collect and keep the data (Vincent Manancourt/Politico)