A federal appeals court has ruled this morning that the NSA’s controversial bulk phone data collection program is in violation of federal law.

The ruling (PDF) from the 2nd Circuit U.S. Court of Appeals in New York is a response to the lawsuit that was dismissed in 2013, when the U.S. District Court in New York held that the NSA’s program was legal. The plaintiffs — the ALCU, mainly — appealed, and the three judges of the appeals court overruled the finding of the lower court.

“Because we find that the program exceeds the scope of what Congress has authorized,” circuit judge Gerard E. Lynch wrote, “we vacate the decision below dismissing the complaint without reaching appellants’ constitutional arguments.”

With the decision to dismiss the lawsuit vacated and remanded back to the lower court, the ACLU can now pursue its arguments against the NSA and Department of Justice.

The specific law in question is Section 215 of the Patriot Act — at this moment, up for renewal or alteration in Congress. The NSA has justified their expansive, warrantless phone metadata collection — who called whom, when, from where, and for how long — under Section 215 for years.

But, the appeals court holds, “[Section] 215 and the statutory scheme to which it relates do not preclude judicial review, and that the bulk telephone metadata program is not authorized by § 215.”

The court recognizes that metadata have always existed and have always been available to investigators. For example, anyone can look at the outside of an envelope and make some shrewd deductions about the contents. But the scope and structure of the NSA’s phone metadata program make it different:

[T]he structured format of telephone and other technology‐related metadata, and the vast new technological capacity for large‐scale and automated review and analysis, distinguish the type of metadata at issue here from more traditional forms.  The more metadata the government collects and analyzes, furthermore, the greater the capacity for such metadata to reveal ever more private and previously unascertainable information about individuals.  Finally, as appellants and amici point out, in today’s technologically based world, it is virtually impossible for an ordinary citizen to avoid creating metadata about himself on a regular basis simply by conducting his ordinary affairs.

The court’s ruling ends on a note of caution. “This case serves as an example of the increasing complexity of balancing the paramount interest in protecting the security of our nation … with the privacy interests of its citizens in a world where surveillance capabilities are vast and where it is difficult if not impossible to avoid exposing a wealth of information about oneself to those surveillance mechanisms,” the ruling concludes.

Want more consumer news? Visit our parent organization, Consumer Reports, for the latest on scams, recalls, and other consumer issues.