GCHQ breached human rights laws when they hatched massive internet surveillance operations Prism and Upstream. The UK intelligence service accessed information obtained by its US counterpart the National Security Agency (NSA).
But the sharing has today (6 February) been deemed unlawful by the Investigatory Powers Tribunal (IPT) after a ruling last year, which declared it legal, was challenged by civil liberties groups Liberty, Privacy International, and others.
They claimed surveillance gathered by the (NSA) under the Prism and Upstream programmes, whose existence was revealed by US whistleblower Edward Snowden, should not have been shared with UK authorities.
Eric King, deputy director of Privacy International, said: "For far too long, intelligence agencies like GCHQ and NSA have acted like they are above the law. Today's decision confirms to the public what many have said all along — over the past decade, GCHQ and the NSA have been engaged in an illegal mass surveillance sharing program that has affected millions of people around the world.
"We must not allow agencies to continue justifying mass surveillance programs using secret interpretations of secret laws. The world owes Edward Snowden a great debt for blowing the whistle, and today's decision is a vindication of his actions.
"But more work needs to be done. The only reason why the NSA-GCHQ sharing relationship is still legal today is because of a last-minute clean-up effort by government to release previously secret 'arrangements'.
"That is plainly not enough to fix what remains a massive loophole in the law, and we hope that the European Court decides to rule in favour of privacy rather than unchecked State power."
The tribunal's ruling is the first time in its 15-year history that it has found against GCHQ, MI5 and MI6.
In a previous December 2014 ruling, the IPT held that GCHQ's access to NSA data was lawful from that time onward, meaning the sharing that took place before that date was not.
Elizabeth Knight, legal director at Open Rights Group, another plaintiff, said: "This ruling is a very welcome first step. It shows that secret polices are not an acceptable basis for highly intrusive intelligence sharing practices. However, the IPT has not gone far enough. These flimsy policies are not enough to comply with the requirements of human rights law, even now they are public."