May as well leave security services to do as they wish collecting data
Legal frameworks regulating state security data collection activities are, at best, cosmetic and of no avail. This is because ordinary citizens cannot just knock on the door of GCHQ and its like and demand to verify legitimacy of activities. Oversight devolves to government ministers, parliament, judiciary, and perhaps a committee of the Privy Council.
Government ministers have conflict of interest because they may draw upon information derived from surveillance. As evinced by numerous IT cock-ups presided over by ministers, they, regardless of political party, are (proudly?) ignorant of matters mathematical, scientific, technological, and computational. They are incapable of detecting attempts by sharper minds than theirs to pull wool over their eyes. Parliament and its committees are equally devoid of capacity to detect male bovine excrement.
Senior judiciary generally have very sharp intelligence but very few are equipped to probe deeply into data related activity at GCHQ, MI5/6, etc. The Privy Council is a non-starter because it supports the Crown, i.e. embedded kakistocracy, rather than subjects of the Crown.
The only setting where data malfeasance could be detected is during a trial when provenance of information is challenged. That is wholly theoretical in two respects. First, trials bringing forth 'sensitive' information take place behind closed doors. Second, security and police forces need not reveal nefarious means of investigation which are merely 'leads' to findings capable of independent verification (e.g. we acted on a tip off and found the data and physical evidence now presented to the court).
Thus, there is little point to getting upset about mass surveillance through tapping into the Internet. The strongest objection to mass surveillance rests on its inefficiency. That is, collecting masses of data on off-chance of it being useful is mindless compared to setting skilled people onto targeted investigations.
Regardless, honest citizens and competent crooks have access to various means of protecting their digital security. At very least they can obfuscate their activities such that mere data trawling does not arouse suspicions for follow-up by targeted surveillance.