A UK tribunal has ruled that intelligence agency GCHQ did not follow proper procedures when collecting data on two international NGOs.
The Investigatory Powers Tribunal found that the agency breached its own internal policies in handling the information of the Egyptian Initiative for Personal Rights (EIPR) and the Legal Resources Center (LRC) of South Africa.
However, the tribunal did find that the original interception of the data was lawful and proportionate.
The tribunal found that the EIPR’s email communications had been lawfully intercepted but the data was retained for longer than the relevant retention time limit.
In the case of the LRC, the tribunal said the interception was lawful but GCHQ did not follow internal policies for examining those communications.
According the the tribunal, as there was no material damage in both the cases, no compensation is required.
The IPT ruling said: "The tribunal is concerned that steps should be taken to ensure that neither of the breaches of procedure referred to in this determination occurs again.
"For the avoidance of doubt, the tribunal makes it clear that it will be making a closed report to the prime minister."
A Government spokesperson said: "We welcome the IPT’s confirmation that any interception by GCHQ in these cases was undertaken lawfully and proportionately, and that where breaches of policies occurred they were not sufficiently serious to warrant any compensation to be paid to the bodies involved.
"GCHQ takes procedure very seriously. It is working to rectify the technical errors identified by this case and constantly reviews its processes to identify and make improvements."
It was the third and final judgment on concerns raised by Liberty, Privacy International and others to the lawfulness of the UK’s bulk interception powers and of the intelligence-sharing arrangements between the UK and the US National Security Agency.
