Under the Investigatory Powers Act (IPA), MI5 has the authority to collect, upon authorization, personal data of a large number of innocent people and store it for potential future investigations. Security services, however, cannot store such data indefinitely: they are obliged to delete it within certain time limits.
Moreover, a senior official from the intelligence service said that people's personal data was being kept in "ungoverned spaces," the rights group said in a statement, published on its official website.
"These shocking revelations expose how MI5 has been illegally mishandling our data for years, storing it when they have no legal basis to do so. This could include our most deeply sensitive information – our calls and messages, our location data, our web browsing history," Liberty lawyer Megan Goulding said, as quoted by the rights group.
"Without seeking to be emotive, I consider that MI5's use of warranted data ... is currently, in effect, in 'special measures' and the historical lack of compliance ... is of such gravity that IPCO [Investigatory Powers Commissioner’s Office] will need to be satisfied to a greater degree than usual that it is 'fit for purpose'" Fulford said as quoted by the Liberty website.
"Warrants for bulk surveillance were issued by senior judges (known as Judicial Commissioners) on the understanding that MI5's data handling obligations under the IPA were being met - when they were not," Liberty said.
The rights group raised the alarm about MI5's violations in May, prompting the investigatory powers commissioner to start an investigation into the matter.
