According to the court, the spies were able to find out far too much about people’s habits and contacts, by examining their online activities. It also said the surveillance had an illegally chilling effect on the free press, by monitoring journalists’ communications.

The case was brought to the court a couple years back by more than a dozen human rights groups, including Amnesty International and the American Civil Liberties Union, who were frustrated that the revelations of NSA whistleblower Edward Snowden had not sufficiently reined in the U.K.’s GCHQ intelligence agency.

Snowden showed that GCHQ routinely intercepts, stores and analyzes enormous quantities of Internet traffic—something it’s able to do because so many global Internet cables cross the U.K. He also provided evidence of massive data-sharing between the British and American signals intelligence agencies.

The human rights groups did not get what they wanted from the U.K.’s intelligence services watchdog, the Investigatory Powers Tribunal, which said GCHQ’s use of NSA-intercepted data had been illegal, but became legal when people found out about it, thanks to Snowden. So the groups turned to the European Court of Human Rights.

The court said Thursday that GCHQ’s mass surveillance scheme was not intrinsically illegal, but its design broke two crucial elements of the European Convention on Human Rights: Article 8, the part that guarantees privacy; and Article 10, which guarantees freedom of expression.

The spies infringed on people’s privacy rights because there wasn’t enough oversight or safeguards regarding how data was selected for surveillance. They infringed on free-expression rights because the system did not include proper safeguards for protecting confidential journalistic material—effectively limiting what the press can do without the authorities finding out.

However, the court ruled that GCHQ had not broken European human rights law by using data gathered by U.S. spies, as the safeguards around those procedures were sufficient. It also threw out a set of complaints about the U.K. Investigatory Powers Tribunal being insufficiently independent and impartial.

This is the first time the European Court of Human Rights has dealt with a case involving intelligence sharing. It has however examined cases involving mass surveillance before, and this ruling is in line with those earlier rulings—the court seems to take a somewhat more permissive stance on the issue than the Court of Justice of the European Union, which has repeatedly stamped down on the practice due to the fact that it is indiscriminate.

Although many people mistakenly associate the European Court of Human Rights with the European Union, it is in fact associated with the Council of Europe, an organization whose members also include Russia and Turkey. The ruling acts as precedent for all of the Council of Europe’s 47 member states.

As such, the court’s rulings are legally binding on the British Parliament. However, the U.K. has since updated its intelligence laws and the court did not take the new legislation into account when deciding if the authorities there broke European human rights law. However, that new law—the Investigatory Powers Act—is already being revised after the country’s high court ruled it broke European human rights rules.

“This landmark judgment confirming that the U.K.’s mass spying breached fundamental rights vindicates Mr. Snowden’s courageous whistleblowing and the tireless work of Big Brother Watch and others in our pursuit for justice,” said Silkie Carlo, director of Big Brother Watch, which participated in the case.

“Under the guise of counter-terrorism, the U.K. has adopted the most authoritarian surveillance regime of any Western state, corroding democracy itself and the rights of the British public. This judgment is a vital step towards protecting millions of law-abiding citizens from unjustified intrusion. However, since the new Investigatory Powers Act arguably poses an ever greater threat to civil liberties, our work is far from over.”