A court has issued strict limits on how police can pull innocent bystanders into big data investigations.