The security service MI5 has handled large amounts of personal data in an “undoubtedly unlawful” way, a watchdog has said.
The Investigatory Powers Commissioner said information gathered under warrants was kept too long and not stored safely.
Civil rights group Liberty said the breaches involved the “mass collection of data of innocent citizens”.
The high court heard MI5 knew about the issues in 2016 but kept them secret.
“MI5 have been holding on to people’s data – ordinary people’s data, your data, my data – illegally for many years,” said Megan Goulding, a lawyer for Liberty, which brought the case.