MI5 admitted that personal data had been unlawfully processed and retained between the period of 2016 and 2019 due to failures in retention, review and destruction practicies.

See pg.79 of the open judgment for a summary of the failings of MI5 in their handling of personal data in particular.

For further, more detailed, context regarding the case see the Privacy International press release.