UK government spy agencies broke privacy rules by collecting large amounts of UK citizens’ data without adequate oversight, the Investigatory Powers Tribunal (IPT) has ruled.
Complaints about data collection by GCHQ, MI5 and MI6 were put forward by campaign group.
The findings from the IPT concluded that the UK government breached the European Convention on Human Rights for years by secretly collecting almost everything about British citizens’ communications except their content.
The Investigatory Powers Tribunal, a special court that handles complaints related to British spy agencies, found that access to the datasets had not been subject to sufficient supervision through a 17-year period between 1998 and November 2015.
The tribunal said that due to “failings in the system of oversight” the surveillance regime had violated Article 8 of the European Convention on Human Rights, which protects the right to privacy.
The case was brought in June 2015 by the London-based human rights group Privacy International, which challenged the legality of the surveillance after the British government publicly admitted using an obscure provision of the 1984 Telecommunications Act to harvest the data.
However, now that the UK government has admitted what it is doing, the collection is legal, the court ruled.
It has yet to rule on the issue of proportionality, or whether the agencies’ actions were reasonable given the threat they sought to counter.
The bulk communications data at issue included who contacted whom, when, where and with what equipment, who paid for the call, and how much they paid.
“Just about the only information not included is the content of communications,” the tribunal said in its ruling. Legally collecting that content would have required an interception warrant.
The agencies also gathered bulk personal data, including passport databases, telephone directories, and banking records — even though, the spy agencies acknowledged in a court filing, the majority of the people affected are unlikely to be of intelligence interest.
A spokesperson for the UK government said in a statement: “The powers available to the security and intelligence agencies play a vital role in protecting the UK and its citizens. We are therefore pleased the tribunal has confirmed the current lawfulness of the existing bulk communications data and bulk personal dataset regimes.”