The UK’s spy agencies including MI5, MI6 and GCHQ breached privacy rules by spending 10 years collecting vast amounts of personal information.
Senior judges said the three agencies “failed to comply” with the European Convention on Human Rights (ECHR) when collecting bulk data.
The damning verdict comes from the Investigatory Powers Tribunal which was created to investigate the ways in which the UK’s spy agencies were collecting personal data on members of the public.
The way spy agencies obtained personal data was in breach of the ECHR’s Article 8 - the right to a private life - for more than a decade before it was revealed in March last year.
And the means by which MI5 and GCHQ secured large amounts of communications information, under the previously little-known section 94 the Telecommunications Act 1984, was also not compliant between 1998, when the provision was initially used, and November 2015, when it was officially confirmed in public for the first time.
What was the personal data they collected?
Bulk personal data, referred to as BPD, includes information extracted from passports, travel records, financial data, while bulk communications data (BCD) is the “who, where, when and how” of a person’s telephone calls and emails but not the contents.
Much of the data held relates to individuals who are “unlikely to be of any intelligence interest”, according to the judgment.
Tribunal judge Justice Burton, in the judgment published on Friday, said: “The BPD regime failed to comply with the ECHR principles ... throughout the period prior to its avowal in March 2015.
“The BCD regime failed to comply with such principles in the period prior to its avowal in November 2015, and the institution of a more adequate system of supervision as at the same date.”
The judgment also found that the agencies’ methods since March and November respectively were compliant with Article 8 as a result of improved oversight and the publication of how data is handled.
Privacy International said the judgment was a “long overdue indictment” of the spy agencies.
Millie Graham Wood, the group’s legal officer, said: “The public and Parliament deserve an explanation as to why everyone’s data was collected for over a decade without oversight in place and confirmation that unlawfully obtained personal data will be destroyed.”
And Mark Scott, of Bhatt Murphy Solicitors - who represents Privacy International in the legal challenge, said: “This judgment confirms that for over a decade UK security services unlawfully concealed both the extent of their surveillance capabilities and that innocent people across the country have been spied upon.”
The Government said: “The powers available to the security and intelligence agencies play a vital role in protecting the UK and its citizens. We are therefore pleased the tribunal has confirmed the current lawfulness of the existing bulk communications data and bulk personal dataset regimes.
“Through the Investigatory Powers Bill, the Government is committed to providing greater transparency and stronger safeguards for all of the bulk powers available to the agencies.”