The European Parliament has rejected a proposal to require storage of phone and e-mail records for more than a year for use in anti-terror investigations.
The London bombings prompted the fast-tracking of measures
EU lawmakers said its backers, the UK, France, Ireland and Sweden, had not shown why data should be kept so long.
The four governments will now wait to see if a rival, less stringent plan put forward by the EU Commission is passed.
The parliamentary vote is not binding but may encourage EU member states to back the Commission proposal instead.
Critics of the plan backed by the UK, France, Ireland and Sweden argue that storing data for so long could breach civil liberties.
There are also concerns about the extra cost faced by telecoms firms if forced to retain records for up to three years, as proposed.
German deputy Alexander Alvaro, of the EU assembly's justice and home affairs committee, spoke in a report of "sizeable doubts" about the legal basis for the measures.
He went on: "Aside from the infringement of the protection of personal data of individuals, there is a danger that enormous burdens would be placed on European telecommunications industry."
The EU Commission proposal would set the length of time that telecoms firms have to hold on to phone date at one year instead of three.
E-mail records would only have to be retained for six months, whereas the plan backed by the four governments suggests keeping them for longer.
The data retention proposals are part of 12 anti-terror measures being fast-tracked by EU governments in the wake of the London bombings in July.
Rules on data retention currently differ widely across the 25 EU member states.
Britain, which currently holds the EU presidency, has said it would back the Commission plan if it wins the support of the EU parliament.