In its ruling, the European Union court noted that "that safeguards were not sufficiently robust to provide adequate guarantees against abuse", and said it was particularly concerned that GCHQ can search and examine citizens" "related communications data' - such as location data and IP addresses - without restriction.
However, the court said the sharing of information with foreign government was not in breach of the rules.
Parliament reformed surveillance powers in 2016 and introduced a new watchdog.
It could reassemble the communications, filter them and then analyse the remainder for anything useful to protecting national security.
It determined that the regime covering how the spy agency obtained data from internet and phone companies was "not in accordance with the law".
The UK's mass interception programmes allowing untargeted surveillance of people's emails and internet use breaches individuals' rights to privacy, the European Court of Human Rights has ruled.
What did the court say?. Data can be legally collected in bulk if it can be justified in the interests of national security, but safeguards must be put in place.
The judgement said: "While there is no evidence to suggest that the intelligence services are abusing their powers - on the contrary, the [then British watchdog] observed that the selection procedure was carefully and conscientiously undertaken by analysts, the court is not persuaded that the safeguards governing selection of bearers [internet cables] for interception and the selection of intercepted material for examination are sufficiently robust to provide adequate guarantees against abuse".
Because there was not enough independent oversight of the search and selection processes, there was a violation of the code.
Return to Crystal Palace a possibility, says Loftus-Cheek
Ruben Loftus-Cheek insists he is prepared to be patient as he waits for his chance to have an impact on the first team at Chelsea FC.
In contrast, related communications data is capable "of painting an intimate picture of a person" through mapping social networks, location tracking and insight of who they interacted with.
Is this system still in force?.
"If the government had its own way, it would have gone on secretly conducting surveillance but finally this was found out and it has been ruled unlawful".
A United Kingdom government spokesperson said the government would "give careful consideration to the court's findings" while noting a new "double lock" oversight mechanism on spying had been enacted in 2016 - three years after the revelations first emerged.
While the court's ruling applied to surveillance regimes set down by the UK's Regulation of Investigatory Powers Act of 2000-not the new Investigatory Powers Act passed in 2016, which has not yet come into full effect-some of the provisions ruled to be in violation of the charter remain in the new law.
"This includes the introduction of a "double lock" which requires warrants for the use of these powers to be authorised by a secretary of state and approved by a judge".
"We will push on with our High Court challenge against the Investigatory Powers Act and I'm sure we'll draw on the judgement of today to explain why it means that act is also unlawful", she added.
Commenting on the ECHR's ruling, Silkie Carlo, director of Big Brother Watch, said: "This landmark judgment confirming that the UK's mass spying breached fundamental rights vindicates Mr Snowden's courageous whistleblowing and the tireless work of Big Brother Watch and others in our pursuit for justice".
Founders of the Bureau David and Elaine Potter backed the case.