At minimum, it should be the architects of these programs in the intelligence community. I'm not sure of the UK case, but in the US and many other countries the intelligence agencies just kind of took it upon themselves to do these things "for national security" whether it was lawful or not. Sometimes they retroactively had laws passed to attempt to make it legal. The situation is probably the same in the UK. Now we know for sure that it was not legal in the UK to do this. So those that designed these programs should be held to account. That means the top brass at these agencies. They have a ton of resources that they could have used to know this was probably illegal or at least might have been deemed illegal. They chose to either ignore those warnings or never sought out council in the first place because they never thought 1) they would be caught doing what they are doing or 2) that even if they were caught it wouldn't be found illegal and if it was nothing would ever happen to them because they would be protected.

There are arguments to be made in their defense, sure. Most likely regarding intent and what a reasonable person could/should have known. And that's what a court is for. But they should absolutely at least be charged so a case can be made. If the people of the UK accept that they were acting in good faith, then fine. But to me, all of this stuff looks like an intentional screw job that they tried to make legal after the fact, which has now failed. And the fact remains that we know for sure now that they have been violating the law. If we know this with certainty, cases should be brought.