UK intelligence agencies MI5, MI6 and GCHQ violated the law by collecting and examining data of human rights group Privacy International, a court said on Tuesday.
The data was collected as part of two mass surveillance programmes called Bulk Communications Data and Bulk Personal Datasets, the Investigatory Powers Tribunal said.
"We do not know why MI5 reviewed Privacy International's data, but the fact that it happened at all should raise serious questions for all of us," Caroline Wilson Palow, general counsel of Privacy International, said in a statement.
Privacy International has challenged both spy programmes before the Investigatory Powers Tribunal, a court specifically set up to hear claims against UK intelligence agencies.
MI5 deleted the information it had gathered on the NGO on Monday, one day before the court notified Privacy International about the illegal collection.
"Today's revelations are troubling for a whole host of reasons. The UK intelligence agencies' bulk collection of communications data and personal data has been shown to be as vast as we have always imagined - it sweeps in almost everyone, including human rights organisations like Privacy International," Wilson Palow said.
"Not only was Privacy International caught up in the surveillance dragnet, its data was actually examined by agents from the UK's domestic-facing intelligence agency - MI5."
In response to the revelation, Privacy International sent a letter to the UK's Home Secretary Sajid Javid demanding action against the intelligence agencies.
Lack of safeguards
The revelation comes a week after the European Court of Human Rights said the UK was violating human rights with its mass surveillance programmes.
The European court specifically singled out the lack of oversight about data collection.
"Today's revelations highlight the danger that can arise from such a lack of safeguards, the absence of which has allowed an intelligence agency to extract data about a human rights charity from that massive trove," Privacy International's statement said.
In January, Britain's Court of Appeals ruled the UK government was breaking the law with its Data Retention and Investigatory Powers Act, which allowed the UK to collect internet activity and phone records of its citizens.
