U.K. spies broke the law by getting information from the U.S. to snoop on their own residents, a British legal tribunal said on Friday.
The Investigatory Powers Tribunal ruled that, until December, the arrangement for the National Security Agency (NSA) to share email and phone records with its U.K. counterpart, the Government Communications Headquarters (GCHQ), violated laws on human rights because details of the deal were secret.
The ruling is the first time the 14-year-old legal tribunal tasked with overseeing U.K. spying authorities has upheld a complaint against an intelligence agency.
{mosads}Before new disclosures made in December, the deals over the NSA’s programs “contravened” two articles of the European Convention on Human Rights, the court said in an order on Friday, “but now comply.” The two articles relate to protections for privacy and to freedom of expression.
The complaint, which had been filed by groups including Amnesty International and Privacy International, focused on a pair of NSA programs exposed in leaks from Edward Snowden.
The Upstream and Prism programs allow the NSA to collect information from Facebook, Google, Yahoo and other major websites, both from their servers and through the undersea cables that transport data back and forth between the continents.
The activity was illegal because people were unaware of the rules that had been put into place to govern the sharing of information, the court said.
It remains unclear what impact the ruling will have on the current spy agencies’ arrangements. In a statement after the verdict, the GCHQ said the new ruling “reaffirms” the current structure.
Still, critics of the spying are crying victory.
“Today’s decision confirms to the public what many have said all along — over the past decade, GCHQ and the NSA have been engaged in an illegal mass surveillance sharing program that has affected millions of people around the world,” Privacy International Deputy Director Eric King said in a statement.
His group will ask the court to confirm that the previously collected information was illegal, he added, and delete it if so.