Judges said the Data Retention and Investigatory Powers Act (Dripa) 2014 breached EU law as it allowed the data to be harvested for reasons other than fighting serious crime.
It also enabled police and public bodies to authorise their own access, avoiding prior authorisation by a court or independent body.
Dripa has since been replaced by the Investigatory Powers Act 2016 – dubbed the “snooper’s charter” – which campaigners said would have to be changed in the wake of today’s ruling. Many of the powers that feature in Dripa and were criticised in the case were replicated and even expanded in the new legislation.
“Yet again a UK court has ruled the Government’s extreme mass surveillance regime unlawful," said Martha Spurrier, director of Liberty, the campaign group that represented MP Tom Watson, who brought the case. "This judgment tells ministers in crystal clear terms that they are breaching the public’s human rights. The latest incarnation of the Snoopers’ Charter, the Investigatory Powers Act, must be changed."
The two central findings from the Court of Appeal – that Dripa was being used to collect data for the wrong purposes, and without proper sign-off – still exist in the current legislation. That means that the existing legal framework for the UK to spy on its citizens is "effectively unlawful", Liberty claimed.
The government admitted in November 2017 that the Investigatory Powers Act needed to incorporate some of those criticisms, and recognise citizens' rights more. But campaign groups including Liberty say those proposed changes don't go far enough, and that far deeper alterations need to made to the UK's spying regime.
Campaigners said the decision showed it was time for the Government to revoke some of the more wide-ranging powers it has given itself in recent years, and ensure that data was used properly.
“Once again, another UK court has found another piece of Government surveillance legislation to be unlawful," said Matthew Rice, from Open Rights Group. "The Government needs to admit their legislation is flawed and make the necessary changes to the Investigatory Powers Act to protect the public’s fundamental rights.”
“The Investigatory Powers Act carves a gaping hole in the public’s rights. Public bodies able to access data without proper oversight, and access to that data for reasons other than fighting serious crime. These practices must stop, the courts have now confirmed it. The ball is firmly in the Government’s court to set it right.”
The case brought by Mr Watson was launched in 2014 against the then current Dripa powers. That act allowed government to force communications companies to store detailed information about the locations and uses of phones, which the Labour MP argued was in contravention of British people's fundamental rights.
The Home Office, whose consultation on changes to the Investigatory Powers Act ended last week, insisted the powers were key to prosecuting dangerous offenders, including the paedophile and former Lost Prophets singer Ian Watkins.
Ben Wallace, the security minister, said: "Communications data is used in the vast majority of serious and organised crime prosecutions and has been used in every major security service counter-terrorism investigation over the last decade.
"It is often the only way to identify paedophiles involved in online child abuse as it can be used to find where and when these horrendous crimes have taken place.
"This judgment relates to legislation which is no longer in force and, crucially, today’s judgment does not change the way in which law enforcement agencies can detect and disrupt crimes."
More about: UK