The opinion of the Advocate General is a preliminary document, a recommendationn, not a ruling of the Court. A recommendation to the European Court that is often followed by the Court. Legal grounds is the current EU directive, a directive that is implemented in national laws and provides a level of minimum harmonisation across EU member states. There may be other legal grounds.
Currently the entire EU data protection legislative framework is under reform.