UK surveillance law still full of holes, watchdog warns