The independent tribunal ruled on a case brought by Privacy International, concluding that the UK spy agency GCHQ was acting illegally for 17 years while it amassed huge databases of "bulk collection" data of cellphone location and call-data — a practice revealed by the Edward Snowden docs.
The surveillance violated Article 8 of the European Convention on Human Rights, which the UK Conservative Government had pledged to nullify in the UK, with our without a Brexit.
Last November, Parliament amended the UK's surveillance law to bring some transparency to "bulk collection" by spy agencies, thus legalising the practice, which continues to this day.
The case exposed inadequate safeguards against abuse, including warnings to staff not to use the databases created to house these vast collections of data to search for and/or access information 'about other members of staff, neighbours, friends, acquaintances, family members and public figures'. Internal oversight failed, with highly sensitive databases treated like Facebook to check on birthdays, and very worryingly on family members for 'personal reasons'.The Tribunal ruled that "we are not satisfied that … there can be said to have been an adequate oversight of the BCD system, until after July 2015" with "no Codes of Practice relating to either BCD or BPD or anything approximating to them." There was no statutory oversight of BPD prior to March 2015 and there has never been any statutory oversight of BCD.
Noting the highly secretive nature of the illegal BCD regime, the Tribunal ruled "it seems difficult to conclude that the use of BCD was foreseeable by the public when it was not explained to Parliament".
Press Release: New court judgment finds UK surveillance agencies collected everyone's communications data unlawfully and in secret, for over a decade
[Privacy International/Medium]
UK admits it spied illegally for 17 years, is sorry, won't stop
[Russell Brandom/The Verge]
