Personal data security

Spy agencies illegally collected personal data on British citizens for 10 years, judges rule

British spy agencies broke privacy rules by secretly and illegally collecting massive amounts of UK citizens’ confidential personal information for more than 10 years, top judges have ruled.
Responding to a complaint brought by Privacy International, the Investigatory Powers Tribunal (IPT) has ruled that the collection of bulk personal data – conducted by GCHQ, MI5 and MI6 between 1998 and 2015 – was unlawful.
It ruled that surveillance of individuals’ phone and web use had been taking place without adequate safeguards or supervision for more than a decade.
It also says some instances of data collection were in breach of Article 8 of the European Convention on Human Rights (ECHR), which ensures all citizens have the right to a private life and that any interference with personal data must be lawful and necessary.
Its collection of ‘Bulk Communications Data’ (BCD) and ‘Bulk Personal Datasets’ (BPD) by the agencies “failed to comply” with ECHR protections until codes of practices were put in place in 2015, the tribunal added.