Britain's spy agencies breached privacy rules on powers used to collect and hold troves of personal information over more than a decade, a tribunal has found.
Senior judges said the security service MI5, intelligence agency MI6 and listening post GCHQ "failed to comply" with the European Convention on Human Rights (ECHR) when collecting and using large databases of individuals' details.
The Investigatory Powers Tribunal (IPT) made the finding in its latest judgment as part of a case brought by campaign group Privacy International over the gathering of both personal and communications data in bulk.
The way spy agencies obtained personal data was in breach of the ECHR's Article 8 - the right to a private life - for more than a decade before it was revealed in March last year.
And the means by which MI5 and GCHQ secured large amounts of communications information, under the previously little-known section 94 the Telecommunications Act 1984, was also not compliant between 1998, when the provision was initially used, and November 2015, when it was officially confirmed in public for the first time.
Bulk personal data, referred to as BPD, includes information extracted from passports, travel records, financial data, while bulk communications data (BCD) is the "who, where, when and how" of a person's telephone calls and emails but not the contents.
Much of the data held relates to individuals who are "unlikely to be of any intelligence interest", according to the judgment.
Tribunal judge Justice Burton, in the judgment published on Friday, said: "The BPD regime failed to comply with the ECHR principles ... throughout the period prior to its avowal in March 2015.
"The BCD regime failed to comply with such principles in the period prior to its avowal in November 2015, and the institution of a more adequate system of supervision as at the same date."
The judgment also found that the agencies' methods since March and November respectively were compliant with Article 8 as a result of improved oversight and the publication of how data is handled.
Privacy International said the judgment was a "long overdue indictment" of the spy agencies.
Millie Graham Wood, the group's legal officer, said: "The public and Parliament deserve an explanation as to why everyone's data was collected for over a decade without oversight in place and confirmation that unlawfully obtained personal data will be destroyed."
And Mark Scott, of Bhatt Murphy Solicitors - who represents Privacy International in the legal challenge, said: "This judgment confirms that for over a decade UK security services unlawfully concealed both the extent of their surveillance capabilities and that innocent people across the country have been spied upon."
The Government said: "The powers available to the security and intelligence agencies play a vital role in protecting the UK and its citizens. We are therefore pleased the tribunal has confirmed the current lawfulness of the existing bulk communications data and bulk personal dataset regimes.
"Through the Investigatory Powers Bill, the Government is committed to providing greater transparency and stronger safeguards for all of the bulk powers available to the agencies."