It's not quite obvious. British constitutional theory holds Parliament to be completely sovereign - so the concept of an illegal piece of statute law is a bit alien.
The only real constraints on Parliament's freedom of legislation are the body of EU law, and the European Convention on Human Rights. The former is variously directly and indirectly applicable in UK law, and the latter is enforced both by UK statute (which can be overridden by Parliament) and by oversight from an external court (which has limited enforcement powers).
I agree that the surveillance law is obviously bad policy, but it wasn't obviously in breach of either EU law or the ECHR. The English court of appeal thought that it wasn't, but referred it to the Court of Justice of the European Union for a binding opinion, because they decided the question was finely balanced. CJEU ruled that it was in breach of articles 7 and 8 of the Charter of Fundamental Rights of the European Union, so the Court of Appeal made a domestic declaration that the statute was in breach of EU law.
The only real constraints on Parliament's freedom of legislation are the body of EU law, and the European Convention on Human Rights. The former is variously directly and indirectly applicable in UK law, and the latter is enforced both by UK statute (which can be overridden by Parliament) and by oversight from an external court (which has limited enforcement powers).
I agree that the surveillance law is obviously bad policy, but it wasn't obviously in breach of either EU law or the ECHR. The English court of appeal thought that it wasn't, but referred it to the Court of Justice of the European Union for a binding opinion, because they decided the question was finely balanced. CJEU ruled that it was in breach of articles 7 and 8 of the Charter of Fundamental Rights of the European Union, so the Court of Appeal made a domestic declaration that the statute was in breach of EU law.
The full judgment is at http://www.bailii.org/ew/cases/EWCA/Civ/2018/70.html, if you're interested.