GCHQ and MI5 'illegally' collected bulk data on UK citizens for 'over a decade'

British spies at GCHQ and MI5 unlawfully collected bulk data on UK citizens without sufficient oversight or safeguards for over 10 years, according to the Investigatory Powers Tribunal (IPT) – the legal body that rules on complaints against UK security and intelligence services.

In a case brought forward by campaigning group Privacy International, the Tribunal found the collection of bulk communications data (BCD) and bulk personal datasets (BPDs) was in breach of Article 8 of the European Convention of Human Rights (ECHR).

"The BPD regime failed to comply with the ECHR principles which we have above set out throughout the period prior to its avowal in March 2015," the court ruled, adding the "BCD regime failed to comply with such principles in the period prior to its avowal in November 2015."

In a 70-page ruling, the court found the proper legal backing was finally put in place last year however called out the intelligence community for not reporting the use of bulk collection to elected officials sooner. It said it "seems difficult to conclude that the use of BCD was foreseeable by the public, when it was not explained to Parliament."

"Several opportunities [to inform] arose when legislation or codes of practice were being introduced or amended (and particularly in 2000 when s.80 of RIPA was passed), when the government of the day did not avow the use of section 94 [which governs communications intercepts]," it said.

Unlike MI6, GCHQ and MI5 both collect and store bulk communications data including the metadata gleaned from internet browsing, emails, GPS locations, phonecalls and text messages. Meanwhile, all three agencies store bulk personal datasets – which can include electoral registers, medical records and tax histories.

"The majority of individuals whose personal data is contained in a BPD will be of no intelligence interest," the intelligence agencies admit. The judgment does not specify whether the sensitive personal data determined to be collected unlawfully will be deleted.

Despite the Tribunal ruling the agencies' use of these bulk data systems now have legal backing, Privacy International maintains that safeguards remain inadequate, arguing that there is still no procedure for notifying the victims of any misuse of bulk data collection.

The campaigning group called the released of the IPT report "one of the most significant indictments of the secret use of the Government's mass surveillance powers since Edward Snowden first began exposing the extent of US and UK spying in 2013."

Millie Graham Wood, Legal Officer at Privacy International said: "Today's judgment is a long overdue indictment of UK surveillance agencies riding roughshod over our democracy and secretly spying on a massive scale.

"There are huge risks associated with the use of bulk communications data. It facilitates the almost instantaneous cataloguing of entire populations' personal data. It is unacceptable that it is only through litigation by a charity that we have learnt the extent of these powers and how they are used.

"The public and Parliament deserve an explanation as to why everyone's data was collected for over a decade without oversight in place and confirmation that unlawfully obtained personal data will be destroyed."

In a statement to the BBC, the UK Home Office said: The powers available to the security and intelligence agencies play a vital role in protecting the UK and its citizens. We are therefore pleased the tribunal has confirmed the current lawfulness of the existing bulk communications data and bulk personal dataset regimes."