Data retention violates EU law