The government’s data collection “flagrantly violated the law”, says a legal report.