However, the tribunal heard evidence that Whitehall officials had not properly supervised GCHQ's requests, prompting the agency to gather more data than was necessary.

When phone and internet companies were asked to hand over information, more was provided than was needed because the companies were "not... in any position to question the scope of the requirement" and had "no knowledge of the limited basis upon which the direction had been made".

Michael Burton, president of the tribunal, stressed there was no evidence GCHQ had tried to obtain data beyond what was allowed by the foreign secretary, and that since at least 2014 “great care was taken.”

The tribunal also said that on several other issues, including the sharing of data with commercial partners, the government had not broken the European Convention on Human Rights.

On Monday, the tribunal also updated its initial ruling from a previous case to say that laws protecting UK citizens’ data had not been followed in full until October 2016, not November 2015 as it had previously concluded.

A government spokesperson said the unlawful requests for citizens’ data referred to in the tribunal’s judgment had since been replaced and were no longer in force.