The ruling comes after former National Security Agency contractor Edward Snowden revealed that GCHQ and the NSA were intercepting vast amounts of communications from across the world.
The Government Communications Headquarters is the UK’s cyber intelligence agency. It's website says it keeps the UK safe by "combining cutting-edge technology with technical ingenuity".
Human rights campaigners brought the case as they contended that so-called bulk interception was neither necessary nor proportionate, and that the system lacked clear definition and lacked judicial oversight.
The British government argued that bulk interception was critical for national security and had enabled it to uncover threats. Essentially, London argued that it had to harvest vast amounts of data to find threats.
The Strasbourg-based court ruled in a case known as "Big Brother Watch and Others v. the United Kingdom" that the United Kingdom had breached the right to respect for private and family life communications, and the right to freedom of expression with its bulk intercept regime.
The regime for obtaining communications data from service providers also violated human rights, the court said, though it said bulk interception in itself was not illegal.
"The court considered that, owing to the multitude of threats states face in modern society, operating a bulk interception regime did not in and of itself violate the Convention," the court said.
"However, such a regime had to be subject to 'end-to-end safeguards'," it said.
The court ruled that there had been no violation of rights by requests for intercepted material from foreign intelligence agencies.
A Home Office spokesperson said much of the legal framework that was the subject of the challenge has since been replaced.
“The UK has one of the most robust and transparent oversight regimes for the protection of personal data and privacy anywhere in the world” he said.
“This unprecedented transparency sets a new international benchmark for how the law can protect both privacy and security whilst continuing to respond dynamically to an evolving threat picture.
“The 2016 Investigatory Powers Act has already replaced large parts of the 2000 Regulation of Investigatory Powers Act (RIPA) that was the subject of this challenge. We note today’s judgment.”