The NSA has broken privacy rules or overstepped its legal authority thousands of times a year since Congress gave it broad new powers in 2008.