CJEU rules member states must restrict surveillance practices