GCHQ’s mass data-sharing violated right to privacy, court rules