Mass internet surveillance of British citizens was unlawful and breached human rights, a court ruled on Friday morning.
In the first such ruling against a British intelligence service, the Investigatory Powers Tribunal (IPT) said that the "receiving, storing and transmitting" of private information in the past was unlawful.
The ruling said both article 8, the right to privacy, and article 10, which guarantees freedom of expression, of the European Convention on Human Rights were breached, but that the scheme "now complies".
This reverses an earlier ruling from December in which the IPT found that the activity was lawful. Challenges were brought by charities, including Liberty and Privacy International.
They argued that GCHQ's participation in the NSA's secret Upstream and Tempora internet surveillance programmes – as revealed by Edward Snowden and The Guardian – was illegal. Lawyers for the UK government refused to admit during the hearing that Tempora even exists, it was reported.
This is the key part of the ruling:
In two dry paragraphs, a damning ruling for GCHQ and the NSA
James Welch, legal director for Liberty, said in a press release:
We now know that, by keeping the public in the dark about their secret dealings with the National Security Agency, GCHQ acted unlawfully and violated our rights. That their activities are now deemed lawful is thanks only to the degree of disclosure Liberty and the other claimants were able to force from our secrecy-obsessed Government.
But the Intelligence Services retain a largely unfettered power to rifle through millions of people's private communications – and the Tribunal believes the limited safeguards revealed during last year's legal proceedings are an adequate protection of our privacy. We disagree, and will be taking our fight to the European Court of Human Rights.
In a statement, a GCHQ spokesperson said the court had found the "UK's bulk interception regime is fully lawful". GCHQ argued that the ruling is based on two paragraphs of information it disclosed during this case:
The IPT has, however, found against the government in one small respect in relation to the historic intelligence-sharing legal regime.
The court has ruled that the public disclosure of two paragraphs of additional detail, voluntarily disclosed by the government during the litigation, were essential to make the public regime sufficiently foreseeable and therefore fully compatible with the European Convention of Human Rights.
They found that to the extent that these two paragraphs were not previously in the public domain, the intelligence-sharing regime prior to that point was in contravention of human rights law.
The statement added that "the judgment does not in any way suggest that important safeguards protecting privacy were not in place at all relevant times."
GCHQ says that the ruling doesn't mean it will have to "change what it does to protect national security in any way."
A spokesperson for the prime minister said that the surveillance scheme was "found fully, fully lawful" and "compliant with the right to privacy at all times". She continued:
What they said was, on the legal framework governing that, that there should be more about the rules that should be disclosed publicly. I think it was two paragraphs of additional detail, and the government did that during the proceedings.
They are not questioning in this judgment that the safeguarding of privacy was in any way jeopardised and the judgment will not require GCHQ to change what it does.