A Canadian federal court has dealt the country's spy agency a major blow by declaring it illegally kept data collected during investigations over the past decade.
It has also threatened sanctions if it happens again.
Although judges have previously criticised the Canadian Security Intelligence Service (CSIS) for a lack of openness, the ruling is being seen as particularly uncompromising.
Federal Court Judge Simon Noel said CSIS secretly set up a special data analysis centre in 2006 to help track potential terrorism suspects.
However, he said it stored and retained electronic information from people not linked to particular threats, which it was not permitted to do.
"CSIS has a limited mandate which does not permit the retention of associated data ... as it has done so since 2006. Therefore this retention of associated data is illegal," Judge Noel said in the ruling.
The agency's director, Michel Coulombe, said it would immediately stop sharing and analysing such data until it could assess the potential operational and legal impact of the ruling.
Canada belongs to the so-called Five Eyes intelligence-sharing network, along with Britain, the United States, Australia and New Zealand.
Critics said the ruling reinforced their belief that CSIS was largely unaccountable.
"The fact that CSIS could go 10 years retaining large quantities of our sensitive private information, yet we're only finding out about this now, and only as a result of a court judgement, is deeply concerning," said David Christopher of OpenMedia, an advocacy group.
The case came to light in early 2016 after CSIS applied for amendments to the court warrants it needs to launch probes. At the same time, the court learned independently about the data centre and launched an investigation.
Judge Noel said CSIS broke its duty of candour toward the court by not disclosing the existence of the data analysis centre.
Noting that judges had twice previously concluded the agency improperly obscured details of its operations, he suggested CSIS could be charged with contempt of court.
Federal Public Safety Minister Ralph Goodale, who has overall responsibility for law enforcement agencies, welcomed the ruling and said the government would not appeal it.
"I also take very seriously the explicit finding by Justice Noel that CSIS had failed in its duty to be candid with the court. I will be pursuing this criticism with the executive management of the Service," Goodale said in a statement.
Most Canadian security agencies have small individual review bodies, which OpenMedia and others complain are impotent and can only look at old cases.
Oversight is more robust in other nations such as Britain and the United States, where special legislative committees monitor the work of security and intelligence agencies.
Ralph Goodale, acting amid global concerns about the reach of security agencies, promised in June to create a similar oversight committee as part of a comprehensive probe into how national security is handled.
A scandal erupted this week in the province of Quebec when it emerged that police had secretly tracked phone calls received and made by six reporters.
Prime Minister Justin Trudeau said yesterday he found the case troubling and had contacted CSIS to make sure the agency was not carrying out similar operations.