The MI5 security service handled large amounts of personal data in an "arguably unlawful" manner, a watchdog said.
The Commissioner for Research Powers said the information collected under warrants was kept for a long time and was not stored safely.
Freedom civil rights group said the violations involved the "mass collection of data of innocent citizens."
The higher court heard the MI5 know about the problems in 2016 but kept them a secret.
"MI5 has kept people's data – data from ordinary people, their data, my data – illegally for many years," said Megan Goulding, Liberty's lawyer, who is responsible for the case.
"Not only that, they have been trying to secretly keep their really serious mistakes – security guard dog secrets, they should know about them, Home Office secrets, prime minister secrets and public secrets."
MI5's criticisms came up in the Supreme Court on Monday, when Liberty challenged parts of the Investigational Powers Act.
Under the law, MI5 may require judges to obtain information such as location data, calls, messages, and web browsing history.
In addition to collecting "mass data", which may include information about common members of the public, MI5 may use targeted communications intercepts and computer intrusions for investigations, such as counter-terrorism.
But the act includes safeguards on how all of this information is stored and manipulated. It is against the law to keep the data when it is no longer needed or to store it in an unsafe way.
MI5 had a "historic lack of compliance" with the law, said Lord Justice Adrian Fulford, who oversees the use of data by the security service as Commissioner of Investigating Powers.
In a ruling revealed during the trial, he said that the security service would be placed under more scrutiny by judges when they seek warrants in the future – which the commissioner compared to a bankrupt school being placed in "special measures."
Liberty said the revelations meant that some of the warrants issued for MI5 may not have been legal because the security service had known for several years that it was not manipulating the data correctly but did not tell the judges.
& # 39; Serious Risks & # 39;
The court heard that senior members of MI5 had known for three years that there were serious problems with data management.
MI5 reported the Home Office and number 10 concerns in April this year, but the commissioner said they should have revealed them earlier.
The discussions between lawyers and clients were among the information mistakenly maintained by the security service, Liberty said.
The pressure group said that such material should be protected by legal privileges, but instead was being seen by the people in MI5.
MI5 lawyers said they could not explain the exact nature of the violations at a public hearing, not because they were "embarrassing," but because there were "serious national security issues."
The security service has already taken "immediate and substantial steps" to comply with the law, Interior Secretary Sajid Javid said.
Julian Milford, a representative of Mr. Javid and Foreign Secretary Jeremy Hunt, acknowledged in court "the existence of serious compliance risks."
But he said that these specific issues were a "complete irrelevance" to the Liberty court case, which was challenging the legality of the entire information collection system created by the Investigational Powers Act.