"It is the GCSB's responsibility to act within the law, and it is hugely disappointing that in this case its actions fell outside the law," John Key said in a statement, adding the blunder was the result of "basic errors".