Privacy campaigners were celebrating victory on Friday following a ruling by the Investigatory Powers Tribunal (IPT), which declared that sharing information obtained from the mass interception of communications by GCHQ with US authorities breached human rights laws. The decision followed a challenge brought by campaign groups including Privacy International and Liberty.

The information sharing between UK and US authorities emerged as a result of documents uncovered by whistleblower Edward Snowden and is understood to have taken place over the past seven years. It was facilitated by the Prism and Upstream software, which has already been widely condemned and whose use prompted Ed Miliband to call for full ministerial oversight of the security services in order to ensure they did not wield “unaccountable power”. The existence of a third program, called Tempora, could not be established by the tribunal because Charles Farr, Director of the Office for Security and Counter-Terrorism, refused to confirm or deny it. An assumption that it did exist was made for the purposes of enabling the legal process to proceed.

Because less stringent US regulations allow the NSA to gather information in ways that would be illegal in the UK, the sharing agreement effectively enabled GCHQ to sidestep protections provided for UK citizens by Parliament. Electronic communications between people in the UK and people based overseas are already exempt from those protections because they are considered ‘external’. This applies to email, social media activity and internet searches.

The IPT found that rules governing the “soliciting, receiving, storing and transmitting” of private communications in the UK were in contravention of Articles 8 and 10 of the European Convention on Human Rights. Article 8 establishes the right to private and family life, an important factor for activists who have been concerned that the interception of private communications potentially makes people vulnerable to blackmail. Article 10 establishes a qualified right to freedom of expression; the acknowledgement of this breach will be particularly important to those arguing that the monitoring of emails between journalists and editors poses a danger to freedom of the press and, thereby, to the public's access to information that is important in maintaining a healthy democracy.

“We must not allow agencies to continue justifying mass surveillance programmes using secret interpretations of secret laws. The world owes Snowden a great debt for blowing the whistle, and today’s decision is a vindication of his actions,” said Eric King, deputy director of human rights watchdog Privacy International, but he added that more needs to be done to close “a massive loophole in the law”.

Privacy International previously voiced concerns about the effectiveness of the Regulation of Investigatory Powers Act (RIPA), which is supposed to safeguard private citizens, in most instances, from having their communications intercepted where no specific warrant to do so has been issued. A consultation on RIPA has just finished collecting evidence and it is likely the Act will be amended. But the National Union of Journalists (NUJ) has expressed concern that this could result in protections being weakened rather than strengthened, creating particular problems for journalists concerned about protecting their sources.

Defending its actions in a statement, GCHQ sought to distinguish between mass surveillance and ‘bulk interception’ of communications by specific individuals being investigated in relation to suspected terrorist offences. It did not comment on how this relates to earlier revelations that it harvested private emails sent between journalists, or on the other material unearthed by Edward Snowden that showed that it had listed journalists as a threat to national security. “Today’s IPT ruling reaffirms that the processes and safeguards within the intelligence-sharing regime were fully adequate at all times – it is simply about the amount of detail about those processes and safeguards that needed to be in the public domain,” it argued.

The government has voiced support for GCHQ and said it will not be asking it to change its working practices, which were updated at the start of this year to comply with an earlier IPT ruling.

Liberty argued that safeguards at GCHQ remain inadequate, and vowed to take the matter to the European Court of Human Rights, a decision supported by Privacy International.

The IPT is expected to examine several further cases relating to GCHQ over the coming weeks.