Mass retention of data only allowed in fight against serious crime, says AG